skills/oxc-project__oxc
1
0
Fork 0
mirror of https://github.com/oxc-project/oxc.git synced 2026-09-14 19:36:11 +08:00
Code Issues Packages Projects Releases Wiki Activity
20,428 Commits 481 Branches 542 Tags
codex/fix-consistent-function-scoping-ancestor
Commit Graph

201 Commits

Author SHA1 Message Date
renovate[bot] 7e9508d1e1 chore(deps): update dependency oxfmt to ^0.67.0 (#26407) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.66.0` →
`^0.67.0`](https://renovatebot.com/diffs/npm/oxfmt/0.66.0/0.67.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.67.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.67.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.66.0/0.67.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.66.0/0.67.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.67.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0670---2026-09-07)

##### 🛡️ Security

-
[`9a612d5`](https://redirect.github.com/oxc-project/oxc/commit/9a612d5)
deps: Update npm packages
([#&#8203;26178](https://redirect.github.com/oxc-project/oxc/issues/26178))
(renovate\[bot])

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-07 15:21:06 +00:00
renovate[bot] 1bb1c8c9e9 chore(deps): update pnpm to v12 (#26381) 
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [pnpm](https://redirect.github.com/pnpm/pnpm/tree/main/pnpm)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`11.25.0` →
`12.3.2`](https://renovatebot.com/diffs/npm/pnpm/11.25.0/12.3.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/12.3.2?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/12.3.2?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/11.25.0/12.3.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.25.0/12.3.2?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v12.3.2`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.3.2):
pnpm 12.3.2

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.3.1...v12.3.2)

#### Patch Changes

- `pnpm audit --fix update` no longer aborts when a vulnerable package
has no safe version inside its declared range
[#&#8203;14508](https://redirect.github.com/pnpm/pnpm/issues/14508). The
run updates every package it can and lists the rest as remaining.

- `pnpm install` no longer reruns root lifecycle scripts when the global
virtual store contains an unfinished-build marker in a package slot that
the current lockfile does not use
[pnpm/pnpm#14485](https://redirect.github.com/pnpm/pnpm/issues/14485).

- Sped up installs that have no lockfile. pnpm now links packages whose
dependency subtree has no peer dependencies into the virtual store while
resolution is still running.

- `pnpm run` and `pnpm exec` now start without reinstalling on
filesystems that keep sub-millisecond mtimes, such as NTFS. Previously,
every run on those filesystems reinstalled first
[pnpm/pnpm#14486](https://redirect.github.com/pnpm/pnpm/issues/14486).

- `pnpm import` now keeps the versions recorded in `package-lock.json`,
`npm-shrinkwrap.json`, or `yarn.lock` when it generates
`pnpm-lock.yaml`. A range in `package.json`, a catalog, or an override
still decides which versions are eligible, and the recorded version is
preferred among them. The generated lockfile previously could pin newer
versions than the source lockfile
[#&#8203;14476](https://redirect.github.com/pnpm/pnpm/issues/14476).

`pnpm import` in a workspace now imports every workspace project into
the shared lockfile. It previously imported only the project in the
current directory.

`pnpm import` now fails with `ERR_PNPM_LOCKFILE_NOT_FOUND` when none of
the three source lockfiles is present. It also fails with
`ERR_PNPM_YARN_LOCKFILE_PARSE_FAILED` when it cannot parse `yarn.lock`.
It previously generated a lockfile from scratch in both cases.

`pnpm import` always resolves locally. It warns when `--pnpr-server` or
the `pnpr-server` setting is given and does not use the server.

- Sped up installs in large workspaces. Discovering the workspace
projects no longer enumerates every matched directory to learn which
manifest files it holds
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Sped up installs in large workspaces. The resolver and the peer pass
allocate less for every dependency edge
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- `pnpm self-update`, `pnpm with`, and automatic package-manager version
switching no longer wait through registry retry delays when a configured
registry has no signatures and `registry.npmjs.org` is unavailable
[#&#8203;14483](https://redirect.github.com/pnpm/pnpm/issues/14483).

- Sped up installs in large workspaces. Saving the lockfile is faster,
and the install finishes without waiting for memory cleanup
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- `pnpm install` now relinks workspace packages when
`publishConfig.linkDirectory` changes. Frozen installs report an
outdated lockfile until it is regenerated
[pnpm/pnpm#14488](https://redirect.github.com/pnpm/pnpm/issues/14488).

- The pnpm npm wrapper keeps its placeholder shebang-less so pnpm 11 can
install pnpm 12 through the version store. Wrapper installs must allow
lifecycle scripts to install the native binary
[#&#8203;14502](https://redirect.github.com/pnpm/pnpm/issues/14502).

- Sped up dependency resolution when there is no lockfile, and for the
dependencies a lockfile does not cover.

- Sped up installs in large workspaces. Workspace `link:` targets and
importer ids are now derived from the paths' suffixes under the
workspace root
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- `pnpm install` now reports "Already up to date" when local tarball
dependencies have not changed
[#&#8203;14495](https://redirect.github.com/pnpm/pnpm/issues/14495).

- `pnpm update` now accepts `--ignore-scripts` and skips lifecycle
scripts during the update
[pnpm/pnpm#14512](https://redirect.github.com/pnpm/pnpm/issues/14512).

- Sped up installs that restore a deleted `node_modules` from a warm
global virtual store. pnpm no longer re-links packages that are already
fully present in the global virtual store
[#&#8203;14510](https://redirect.github.com/pnpm/pnpm/issues/14510).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"
/>
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.3.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.3.1):
pnpm 12.3.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.3.0...v12.3.1)

#### Patch Changes

- Sped up installs in large workspaces: the anchor for re-rendering
workspace `link:` targets is now derived once per project instead of
once per dependency edge, and project ordering hashes paths by their raw
bytes
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- After a self-update from pnpm 12.2 to 12.3, global commands such as
`node`, `npm`, and `yarn` failed with `unexpected argument '--shim'
found`. Global commands now launch normally, and their first launch
migrates the global bin directory to native shims. When self-update
downgrades to pnpm 12.2 or older, it keeps the newer native shims so
those commands continue to work.

- Sped up installs in large workspaces. The check that verifies each
project against the lockfile now runs the projects in parallel
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"
/>
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.3.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.3.0):
pnpm 12.3

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.2.1...v12.3.0)

#### Minor Changes

- Every context-aware global command (`node`, `deno`, `bun`, and the
shims created with `pnpm shim add`) is now a native executable on every
platform, so environment variables whose names are not valid shell
identifiers reach these commands. On Windows, `<name>.exe` replaces the
`.cmd` and `.ps1` shims for them. Shims written by earlier pnpm 12
releases are migrated on the next global install or self-update.

- `pnpm remove` and `pnpm update` now accept `--trust-lockfile`,
`--no-trust-lockfile`, `--trust-policy`, `--trust-policy-exclude` and
`--trust-policy-ignore-after`, the same flags `pnpm install` and `pnpm
add` take, so the supply-chain settings can be overridden for a single
run. `pnpm remove` verifies the lockfile against the active policies the
way `pnpm install` does, and `--trust-lockfile` skips that pass for
every entry, not only the package being removed.

`pnpm` now also honors `--config.trust-lockfile=<value>`, and accepts
the bare `--trust-lockfile` / `--no-trust-lockfile` spelling on the
commands that previously took the setting from the config file alone.

#### Patch Changes

- `pnpm add <local directory>`, `pnpm add <local tarball>`, `pnpm add
file:<path>` and `pnpm add <tarball URL>` work again. A specifier given
without a `<name>@` prefix is no longer read as a registry package name
and rejected with `ERR_PNPM_PACKAGE_MANAGER_ADD_RESOLVE_LATEST`
[#&#8203;14437](https://redirect.github.com/pnpm/pnpm/issues/14437).

- Fixed `pnpm deploy --legacy` ignoring `allowUnusedPatches` supplied
through `--config.allow-unused-patches` or the
`PNPM_CONFIG_ALLOW_UNUSED_PATCHES` environment variable
[pnpm/pnpm#14450](https://redirect.github.com/pnpm/pnpm/issues/14450).

- Fixed `pnpm install --lockfile-only` writing a lockfile that
referenced a missing peer-suffixed snapshot when an npm-aliased
dependency took part in a cyclic peer dependency graph. The following
`pnpm install --frozen-lockfile` failed with
`ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY`
[#&#8203;14449](https://redirect.github.com/pnpm/pnpm/issues/14449).

- `pnpm config` now accepts `-g`/`--global`, `--location`, and `--json`
before its subcommand
[pnpm/pnpm#14421](https://redirect.github.com/pnpm/pnpm/issues/14421).

- `pnpm dedupe` now converges in one pass when it re-resolves a lockfile
created by pnpm 11, so a second run no longer changes the lockfile
[#&#8203;14455](https://redirect.github.com/pnpm/pnpm/issues/14455).

- Fixed detached child processes being terminated on Windows when
another program launches `pnpm` directly, without a shell, as `nr` from
`@antfu/ni` does
[#&#8203;14447](https://redirect.github.com/pnpm/pnpm/issues/14447).

- Fixed `pnpm docs <package>@<version>` ignoring the requested version.
It now opens the selected version's homepage and reports a missing
version instead of opening the package-level homepage
[pnpm/pnpm#14428](https://redirect.github.com/pnpm/pnpm/issues/14428).

- Sped up installs in large workspaces. `pnpm-lock.yaml` is now read
while the workspace projects are being discovered
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Fixed filtered and recursive `pnpm run` and `pnpm exec` hanging when a
script reads from the terminal. Interactive prompts work again in a
script that pnpm never runs alongside another one, such as a single
`--filter`ed project, `--workspace-concurrency=1`, a dependency chain,
or a task declaring `concurrency: 1`
[#&#8203;14397](https://redirect.github.com/pnpm/pnpm/issues/14397).

- Fixed false unmet peer errors for auto-installed peers in linked
workspace packages.

- Fixed npm global installs on Windows so the PowerShell shims invoke
`pnpm.exe`.

- Fixed `pnpm with current <command>` when global options precede it,
such as `pnpm --workspace-root with current --version`
[pnpm/pnpm#14413](https://redirect.github.com/pnpm/pnpm/issues/14413).

A short-option cluster that mixes a global flag with an option owned by
the command, such as `pnpm -ro dist pack-app`, is now parsed like the
same options written after the command.

An option written before the command name is now reported as an unknown
option unless that command accepts it, instead of being taken for the
command to run. `pnpm -P exec echo` and `pnpm -z exec echo` fail the way
`pnpm --tag next exec echo` does.

- Apply pure insertions in zero-context patches at the correct line
instead of one line early.

- Improved peer dependency resolution performance when many packages
reuse the same peer ranges.

- `pnpm outdated` and `pnpm update` now follow local actions and
reusable workflows referenced with GitHub's self-repository syntax
(`uses: $/.github/actions/setup`) when looking for outdated GitHub
Actions, the same way they follow `./` references.

- The `pnpm install --help` descriptions of `--prod` and `--dev` no
longer claim that the flags take precedence over `NODE_ENV`. pnpm does
not read `NODE_ENV` when selecting which dependency groups to install
[#&#8203;14445](https://redirect.github.com/pnpm/pnpm/issues/14445).

- Sped up installs in large workspaces. The check that decides whether
the lockfile needs updating no longer compares every project against
every lockfile entry
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Sped up dependency resolution in large workspaces that use `link:`
dependencies
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- On Linux, pnpm now resolves registry hostnames through the system
resolver (`getaddrinfo`), as it already does on macOS and Windows and as
pnpm 11 did. Previously, an `/etc/resolv.conf` containing an option the
bundled pure-Rust resolver did not recognize, such as `options
no_tld_query`, made pnpm ignore the configured nameservers and silently
query Google's public DNS instead
[#&#8203;14469](https://redirect.github.com/pnpm/pnpm/issues/14469).

- Sped up dependency resolution in large workspaces. The resolver builds
fewer lookup keys for each dependency
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- `catalogMode` and `--save-catalog` no longer move a local path,
tarball, or `workspace:<path>` specifier into a catalog. Such a
specifier is resolved against the project that declares it, so one
catalog entry cannot mean the same directory for every project that
references it
[#&#8203;14437](https://redirect.github.com/pnpm/pnpm/issues/14437).

- Sped up installs in large workspaces. The workspace dependency graph
is now built once per run instead of twice
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Sped up writing `pnpm-lock.yaml` in large workspaces
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Fixed non-frozen installs through a pnpr server failing instead of
regenerating a conflicted lockfile.

- `pnpm update --interactive` renders its checklist the way pnpm 11
does. Group headings and column headers are separators the cursor skips
instead of checkboxes that select nothing. The columns of one group line
up with the next. `a` toggles all and `i` inverts the selection. The
confirmed selection is echoed as a list of package names
[#&#8203;14423](https://redirect.github.com/pnpm/pnpm/issues/14423).

- Fixed `pnpm config` commands targeting global configuration to skip
project package manager version switching, allowing registry
authentication to be configured before pnpm downloads a project-pinned
version
[pnpm/pnpm#14463](https://redirect.github.com/pnpm/pnpm/issues/14463).

- Fixed pnpm retaining the surrounding quotes in `.npmrc` values,
including auth tokens expanded from environment variables. This restores
authentication with registries configured using `:_authToken="${TOKEN}"`
[pnpm/pnpm#14427](https://redirect.github.com/pnpm/pnpm/issues/14427).

- Fetch and tarball errors no longer print the secrets of the URL they
name. Inline `user:pass@` credentials and the query string or fragment
of a signed URL are hidden, so a failed install or `pnpm add <url>`
cannot leak them into terminal scrollback or CI logs.

- When `dist-tags.latest` names a version whose manifest pnpm cannot
read, the error now names that version and the field it could not
decode, instead of reporting the tag as empty.

- Retry transient Windows file-lock errors, including sharing
violations, while linking dependencies with the default (isolated)
`nodeLinker`. This fixes
[pnpm/pnpm#14407](https://redirect.github.com/pnpm/pnpm/issues/14407).

- `pnpm run`, `pnpm exec`, `pnpm rebuild`, and the script shortcuts such
as `pnpm test` now load the pnpmfile, so `updateConfig` hook settings
such as `extraEnv` and `extraBinPaths` reach the scripts they spawn
[#&#8203;14433](https://redirect.github.com/pnpm/pnpm/issues/14433).

- The `pnpm` executable of the npm package now works when the package
was installed without running its install scripts, as under
`--ignore-scripts` or the default build-script block of pnpm and Bun
[#&#8203;14346](https://redirect.github.com/pnpm/pnpm/issues/14346). In
that case it runs through Node.js and, in a terminal, says how to switch
to the native binary.

- Sped up installs in large workspaces. The resolver no longer copies
the whole lockfile before resolving
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- `minimumReleaseAgeStrict` now defaults to `true` when
`minimumReleaseAge` is explicitly configured, whether in
`pnpm-workspace.yaml`, the global `config.yaml`, a `PNPM_CONFIG_*`
variable, or a CLI flag. The built-in 1440-minute default stays
non-strict. Previously an explicit cutoff was treated as non-strict, so
immature versions were silently added to `minimumReleaseAgeExclude`
instead of being gated with a prompt
[#&#8203;14409](https://redirect.github.com/pnpm/pnpm/issues/14409).

- Preserve environment variables whose names are not valid shell
identifiers when launching Node.js installed by `pnpm runtime set node
--global` on Unix
[pnpm/pnpm#14417](https://redirect.github.com/pnpm/pnpm/issues/14417).

- Fixed `pnpm repo` and `pnpm docs` failing to open the Windows browser
from WSL
[pnpm/pnpm#14467](https://redirect.github.com/pnpm/pnpm/issues/14467).

- `pnpm link`, `pnpm outdated`, and `pnpm import` now apply pnpmfile
`updateConfig` hooks before resolving dependencies.

- Fixed standalone installations to preserve the bundled `node-gyp`
files used to build native dependencies.

- Fixed resolution against registries whose version manifests carry
`_npmUser`, `dist.attestations`, `dist.unpackedSize`, `dist.fileCount`,
or `peerDependenciesMeta` in a shape npm does not use. Such a version
was skipped as though it had never been published, so `pnpm add` could
fail with "no version found for the latest tag" even though the registry
served it.

- `pnpm unpublish` now completes the two-factor authentication a
registry asks for instead of failing with `ERR_PNPM_UNAUTHORIZED` while
logged in. A 401 that is an OTP challenge starts the web-based
authentication flow, or prompts for a classic one-time password. The
obtained password is reused by every request of the run
[#&#8203;14464](https://redirect.github.com/pnpm/pnpm/issues/14464).

- On Windows, pnpm now resolves host names through the system resolver
instead of its own DNS client. The built-in client bound a UDP socket
for every lookup, which made Windows Defender Firewall ask to allow
`pnpm.exe` again after every `pnpm self-update`
[#&#8203;14405](https://redirect.github.com/pnpm/pnpm/issues/14405).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"
/>
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.2.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.2.1):
pnpm 12.2.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.2.0...v12.2.1)

#### Patch Changes

- Restored the `pnpm` executable target without a file extension so pnpm
12.1 and earlier can upgrade to newer pnpm 12 releases on POSIX systems.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"
/>
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.2.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.2.0):
pnpm 12.2

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.1.0...v12.2.0)

#### Minor Changes

- Catalogs can now resolve workspace dependencies through the
`workspace:` protocol.

#### Patch Changes

- Fixed `pnpm audit --fix` failing with `ERR_PNPM_INVALID_FIX_OPTION`
when used without a value, including when another flag follows it, as in
`pnpm audit --fix --json`
[#&#8203;13261](https://redirect.github.com/pnpm/pnpm/issues/13261).
Fixed `pnpm audit --fix=override` ignoring the `saveExact` and
`savePrefix` settings when writing vulnerability overrides
[#&#8203;11523](https://redirect.github.com/pnpm/pnpm/issues/11523).

- Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with
URL-scoped npm registry credentials, including bearer tokens, basic
auth, and `tokenHelper`
[pnpm/pnpm#14334](https://redirect.github.com/pnpm/pnpm/issues/14334).

- Fixed detached child processes being terminated after successful
commands on Windows.

- Sped up installs in large workspaces by resolving each named
`workspace:` dependency (`workspace:*`, `workspace:^`,
`workspace:1.2.3`) once and reusing it across every project that
declares it, instead of re-resolving it per project.

- Fixed `pnpm install --fix-lockfile` to derive its repair and
filtered-merge views from one lockfile snapshot.

- Load pnpmfile `updateConfig` hooks before packing so hook-provided
catalogs resolve in `pnpm pack`, `pnpm publish`, and `pnpm stage
publish`
[pnpm/pnpm#14377](https://redirect.github.com/pnpm/pnpm/issues/14377).

- `pnpm deploy` no longer requires `injectWorkspacePackages` to be
enabled. A linked workspace dependency is rewritten to a `file:`
dependency in the dedicated deploy lockfile, and the peer dependencies
it declares are bound to the deployed graph's own resolution.

When a peer resolves to more than one version in that graph the binding
is ambiguous, and choosing between the candidates is exactly what
injecting the package would have decided, so the deploy still fails —
now with `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER`, which names the package, the
peer, and the competing versions, instead of refusing every non-injected
workspace up front, and suggests pinning the peer to one version with an
`overrides` entry as the way to keep deploying without injection
[#&#8203;9386](https://redirect.github.com/pnpm/pnpm/issues/9386).

- Fixed global virtual store hashes for dependency cycles. Every package
that transitively depends on an allowed build now includes the engine in
its store path, independent of traversal order
[pnpm/pnpm#14341](https://redirect.github.com/pnpm/pnpm/issues/14341).

- Fixed `ERR_PNPM_CMD_SHIM_CHMOD` when several installs run at once
against a shared global virtual store. One install could remove a
command shim while another was making it executable
([pnpm/pnpm#14353](https://redirect.github.com/pnpm/pnpm/issues/14353)).

- Fixed the PowerShell shim generated by `npm install -g pnpm` on
Windows so it invokes the native `pnpm.exe` binary
[pnpm/pnpm#14362](https://redirect.github.com/pnpm/pnpm/issues/14362).

- Fixed context-aware global shims on WSL2 so native Linux installations
dispatch through the project runtime.

- `pnpm install` no longer writes global `minimumReleaseAgeExclude`
entries to the project's `pnpm-workspace.yaml`
[pnpm/pnpm#14347](https://redirect.github.com/pnpm/pnpm/issues/14347).

- Fixed `catalog:` ranges in workspace package peer dependencies being
reported as unmet
[pnpm/pnpm#14361](https://redirect.github.com/pnpm/pnpm/issues/14361).

- `globalDir` and `globalBinDir` are honored wherever they are set, so
`pnpm add -g` no longer fails with `ERR_PNPM_GLOBAL_BIN_DIR_NOT_IN_PATH`
after `pnpm config set -g global-bin-dir`
[#&#8203;14336](https://redirect.github.com/pnpm/pnpm/issues/14336). The
global `config.yaml` is read again, `PNPM_CONFIG_GLOBAL_DIR` /
`PNPM_CONFIG_GLOBAL_BIN_DIR` reach the directories derived from them,
and a leading `~/` is expanded before that derivation. A project's
`pnpm-workspace.yaml` still cannot set either key.

- Fixed the install progress line reporting `added 0` under `nodeLinker:
hoisted`, even when packages were linked into `node_modules`
[#&#8203;14348](https://redirect.github.com/pnpm/pnpm/issues/14348).

- An auto-installed optional peer is now resolved to a version its
declared peer range accepts, even when the workspace root depends on
that package at a version outside the range. Previously the root's
version was used and then reported as an unmet optional peer
[#&#8203;13867](https://redirect.github.com/pnpm/pnpm/issues/13867).

- Fixed `pnpm run "/pattern/"` running matching scripts one at a time in
a single project. Matching scripts now run concurrently up to
`workspaceConcurrency`, and their output is prefixed so concurrent lines
remain distinguishable [pnpm discussion
14357](https://redirect.github.com/orgs/pnpm/discussions/14357).

- Fixed a slowdown at the end of a resolving install in a large
workspace. The peer-dependency report now inspects only the projects the
resolution flagged, rather than every project in the lockfile
([pnpm/pnpm#14359](https://redirect.github.com/pnpm/pnpm/issues/14359)).

- Speed up workspace discovery for literal directories and conventional
trailing-star patterns.

Workspace patterns now follow the same dot-directory rule as pnpm 11: a
wildcard no longer matches a dot-prefixed directory, so `packages/*` and
`**` skip `packages/.cache` and `.git`. A pattern that names a
dot-prefixed directory still matches it, as `packages/.cache` and
`packages/.*` do.

- `pnpm audit` now ends its output with a trailing newline, including
the `--json`, `--fix`, and `--ignore` output.

- Retry transient Windows file-lock errors while replacing hoisted
packages during installation.
This fixes
[pnpm/pnpm#14349](https://redirect.github.com/pnpm/pnpm/issues/14349).

- Fixed command-line `--side-effects-cache` overrides being ignored when
`pnpm-workspace.yaml` uses the object form of `sideEffectsCache`
[pnpm/pnpm#14338](https://redirect.github.com/pnpm/pnpm/issues/14338).

- Speed up workspace project discovery in large monorepos: workspace
patterns are now probed concurrently and the discovered projects'
`package.json` files are read in parallel
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Fixed repeated `pnpm dedupe` runs alternating between peer resolutions
when a peer is provided through an npm alias.

- Fixed `pnpm repo <package>` and `pnpm docs <package>` resolving bare
package names through the `latest` tag, and prevented malformed package
ranges from crashing registry selection.

- Fixed non-ASCII characters in configuration values being mangled
during environment-variable substitution. Paths such as `storeDir:
./café-store` are now preserved
[#&#8203;14383](https://redirect.github.com/pnpm/pnpm/issues/14383).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"
/>
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.1.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.1.0):
pnpm 12.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.0.0...v12.1.0)

#### Minor Changes

- `pnpm login` and `pnpm adduser` now record the granted token in the
global `config.yaml`, under the `_auth` setting, with `--scope`'s scope
routed to that registry under `registries`. `pnpm logout` removes it
from there, and still from an `auth.ini` an earlier version wrote.
Tokens already in `auth.ini` keep working.

- A `scope` set in a project's `pnpm-workspace.yaml` is now ignored,
with a warning naming where to set it instead. `pnpm login` records the
scope as a `@scope:registry` route in the machine-global `auth.ini`,
which outranks `~/.npmrc` in every project — so a repository-committed
file could redirect a scope such as `@acme` for all of a user's other
projects after one routine login. Use `--scope`, the `PNPM_CONFIG_SCOPE`
environment variable, or the global config file instead
[#&#8203;13557](https://redirect.github.com/pnpm/pnpm/issues/13557).

- Verified remote build artifacts are persisted in the shared store with
their signed origin metadata. Later installs reverify the artifact
against current trust, policy, platform, and source before reuse, while
invalid remote variants are quarantined per channel
([pnpm/pnpm#13771](https://redirect.github.com/pnpm/pnpm/issues/13771)).

- Persist completed recursive tasks so `--resume-from` skips exactly the
work that passed during a matching interrupted or failed `pnpm -r run` /
`pnpm -r exec` invocation. When no compatible state exists, pnpm retains
its graph-based resume behavior.

- Workspace install, rebuild, pack, publish, stage, and lifecycle work
now starts as soon as its dependencies finish instead of waiting for an
unrelated topological group.

- Added per-task concurrency limits to workspace task orchestration. Set
`tasks.<name>.concurrency` in `pnpm-workspace.yaml` to limit how many
instances of that task may run across workspace projects at once:

  ```yaml
  tasks:
    build:
      concurrency: 2
  ```

- `sideEffectsCache` now declares the whole of how a package's build
output is reused — whether one is restored, whether one is saved, and
the remote tier tha

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on the first day of the month"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-07 08:06:59 +00:00
renovate[bot] 32d0cdcd4b chore(deps): update pnpm to v11.25.0 (#26293) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm))
| [`11.24.0` →
`11.25.0`](https://renovatebot.com/diffs/npm/pnpm/11.24.0/11.25.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.25.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/11.25.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/11.24.0/11.25.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.24.0/11.25.0?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v11.25.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.25.0):
pnpm 11.25

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.24.0...v11.25.0)

##### Minor Changes

- Added an opt-in proof of concept that lets installs reuse a
dependency's build output across machines, by publishing and restoring
signed, organization-scoped artifacts through pnpr instead of running
the lifecycle scripts locally.

Configure it with the new `remoteSideEffectsCache` setting. A workspace
names the eligible `organization` and `packages`; everything describing
the act of signing — `publish`, `keyId`, `builderId`, `trustedKeys`,
`privateKey` and the provenance fields — is refused in
`pnpm-workspace.yaml` and read from the global config file or the
environment instead.

- Added macOS and Windows x64 and arm64 support to remote shared build
artifacts
[pnpm/pnpm#13771](https://redirect.github.com/pnpm/pnpm/issues/13771).

- Added the `audit.ignorePrune` setting. When set to `true`, `pnpm audit
--fix` removes ignored GHSA entries that no longer appear in the audit
report.

- Generalized the experimental shared-artifact protocol so candidates
and signed payloads identify a discriminated subject. Dependency side
effects use package and source-integrity subjects, while workspace tasks
use project and task subjects.

This changes shared-artifact request bodies and signed payloads. A pnpr
server and its clients have to be on matching versions.

- `pnpm init` now pins the latest pnpm version, instead of the version
of pnpm that ran the command. A project scaffolded by an outdated pnpm
therefore no longer inherits that staleness through its own
`devEngines.packageManager` / `packageManager` pin
[#&#8203;7490](https://redirect.github.com/pnpm/pnpm/issues/7490).

The version is read from the `latest` tag on the package-manager
registries. When that lookup cannot answer — no network, an unreachable
or slow registry, `offline`, or a `latest` that the `minimumReleaseAge`
/ `trustPolicy` settings reject — `pnpm init` pins the running version
as before, and never fails or hangs on the lookup. A `latest` that is
older than the running pnpm is never pinned either.

- A `scope` set in a project's `pnpm-workspace.yaml` is now ignored,
with a warning naming where to set it instead. `pnpm login` records the
scope as a `@scope:registry` route in the machine-global `auth.ini`,
which outranks `~/.npmrc` in every project — so a repository-committed
file could redirect a scope such as `@acme` for all of a user's other
projects after one routine login. Use `--scope`, the `PNPM_CONFIG_SCOPE`
environment variable, or the global config file instead
[#&#8203;13557](https://redirect.github.com/pnpm/pnpm/issues/13557).

- Verified remote build artifacts are persisted in the shared store with
their signed origin metadata. Later installs reverify the artifact
against current trust, policy, platform, and source before reuse, while
invalid remote variants are quarantined per channel
([pnpm/pnpm#13771](https://redirect.github.com/pnpm/pnpm/issues/13771)).

- Persist completed recursive tasks so `--resume-from` skips exactly the
work that passed during a matching interrupted or failed `pnpm -r run` /
`pnpm -r exec` invocation. When no compatible state exists, pnpm retains
its graph-based resume behavior.

- Allowed `pnpm update --patches` to refresh registry revisions through
a configured pnpr server while retaining locked package versions.

- Added explicit registry revision selection with `<version>+rN` and
`pnpm update --patches` for refreshing revision artifacts without
changing package versions. Registry-backed lockfile policy checks
recognize historical revisions, and pnpr now preserves safe revision
histories from upstream registries.

- Workspace install, rebuild, pack, publish, stage, and lifecycle work
now starts as soon as its dependencies finish instead of waiting for an
unrelated topological group.

- `pnpm stage approve` now approves several staged packages at once. Run
it without a stage id to pick from the staged versions interactively, or
pass a list of stage ids. The whole batch is approved with a single
one-time password, and pnpm asks for a new one only once the registry
stops accepting it. Inside a workspace, the selected packages are
approved in dependency order, and a package whose workspace dependency
could not be approved is skipped instead of being published against a
dependency that never reached the registry.

- Added per-task concurrency limits to workspace task orchestration. Set
`tasks.<name>.concurrency` in `pnpm-workspace.yaml` to limit how many
instances of that task may run across workspace projects at once:

  ```yaml
  tasks:
    build:
      concurrency: 2
  ```

- Added support for registry replacement tarballs using standard
integrity values, explicit revision fields, registry routing from the
`registries` setting, non-redirecting integrity-addressed URLs,
canonical safe-integer revision numbers, and pnpr proxying for immutable
upstream revision artifacts.

- `sideEffectsCache` now declares the whole of how a package's build
output is reused — whether one is restored, whether one is saved, and
the remote tier that shares it between machines:

  ```yaml
  sideEffectsCache:
    read: true
    write: true
    remote:
      org: acme
      packages: ['native-addon']
  ```

`sideEffectsCache: true`, `sideEffectsCacheReadonly`,
`remoteSideEffectsCache`, and its `organization` field all keep working.
Where a field is set under both spellings the one above wins; where it
is set under only one, it is kept.

Two behaviors change, both bringing this CLI in line with what the Rust
one already did: `sideEffectsCacheReadonly: true` now blocks writing to
the cache, and setting it alongside `sideEffectsCache: false` gives a
read-only view rather than switching the cache off entirely. A cache can
also be declared write-only now, to populate one the run does not read.

- Workspace task orchestration
([pnpm/rfcs#23](https://redirect.github.com/pnpm/rfcs/pull/23)). `pnpm
-r run` and `pnpm -r exec` now schedule per task instead of in
topological chunks: a task starts as soon as the tasks it depends on
have finished, so a project no longer waits for unrelated projects that
happen to share its chunk.

A new `tasks` section in `pnpm-workspace.yaml` declares what a task
depends on, using the `^` convention:

  ```yaml
  tasks:
    build:
      dependsOn: ['^build']
    test:
      dependsOn: ['build']
    lint: {}
  ```

`^name` means the named task in each of the project's workspace
dependencies; a bare `name` means the task in the same project; an entry
with no `dependsOn` declares an empty dependency list. A task with no
entry behaves as `dependsOn: ['^<its own name>']`, which is exactly what
the previous chunked ordering implied — an unconfigured workspace gets
the scheduler improvement and nothing else changes meaning. A project
without the script is reported skipped and passes its edges through to
its own dependencies, so a scriptless package does not sever a chain.

  Also part of this change:

- A dependency cycle among the tasks of a run is now an error naming the
participating tasks (`ERR_PNPM_TASK_CYCLE`) instead of silently running
in an arbitrary order. Setting `ignoreWorkspaceCycles: true` downgrades
the error to a warning: the cycle's tasks run in an arbitrary order
relative to each other.
- `--resume-from` now skips exactly the transitive dependencies of the
anchor package; work unrelated to the anchor still runs.
- Under `--no-bail`, tasks whose dependencies failed are reported as
skipped, not failed, and do not add to the exit code.
- With `--bail` (the default), the first failure still ends the run at
once and nothing new is dispatched — including scripts already queued
behind the concurrency limit.
- `pnpm -r run --dry-run <script>` prints the task graph that would
execute without running anything (including skipping the
`verifyDepsBeforeRun` check); `--json` emits the tasks and their
resolved dependency edges.
- Output is inherited rather than piped only when at most one script can
ever be in flight (`--workspace-concurrency=1`, or the graph forces the
scripts to run one after another).

##### Patch Changes

- An `_auth` entry in the global config file no longer decides which
registry packages come from when something else says. A `registry` or
`registries` declared in `pnpm-workspace.yaml` or the global config now
wins over the route inferred from a stored credential, which still
applies where nothing else declares one. The `pnpm_config__auth`
environment variable is unchanged: it stays the way to point a CI runner
at a mandated proxy, and still overrides what a repository declares.

- Prevent installs through a symlinked `node_modules` directory from
rewriting the target checkout
[pnpm/pnpm#14286](https://redirect.github.com/pnpm/pnpm/issues/14286).

- Treat empty scripts selected by a regular expression as missing before
running dependent tasks.

- The options type of the `fetch` command now declares `allowBuilds`, a
setting its handler already forwarded to the installer. Type-level only
— what `pnpm fetch` does is unchanged.

- Filter hidden scripts matched by a regular expression during recursive
runs when a visible script also matches.

- Fixed automatically switched pnpm versions forcing all descendant pnpm
processes to use the same version
[pnpm/pnpm#14309](https://redirect.github.com/pnpm/pnpm/issues/14309).

- Fixed `ERR_PNPM_UNUSED_PATCH` validation during incremental installs
[pnpm/pnpm#13692](https://redirect.github.com/pnpm/pnpm/issues/13692).

- Fixed `pnpm deploy --prod` failing when an excluded dev dependency was
also declared as an optional peer dependency
[pnpm/pnpm#14302](https://redirect.github.com/pnpm/pnpm/issues/14302).

- `pnpm update -g` no longer downgrades a global package. `--latest`
resolves the `latest` dist-tag, which can point at an older release than
the one installed — after `pnpm add -g <pkg>@next`, for instance
[#&#8203;14270](https://redirect.github.com/pnpm/pnpm/issues/14270).

`pnpm update -g` also no longer changes the pnpm version. pnpm's own
global install belongs to `pnpm self-update`
[#&#8203;14270](https://redirect.github.com/pnpm/pnpm/issues/14270).

- Copying a built package to its other hoisted locations no longer
replaces the destination directory. With `nodeLinker: hoisted`, that
replacement deleted the dependencies nested inside the destination's
`node_modules`, and made concurrent copies of the same build chunk fail
with `ERR_PNPM_ENOENT: no such file or directory, rename
'.../node_modules/_tmp_...'`
[#&#8203;12880](https://redirect.github.com/pnpm/pnpm/issues/12880).

- `pnpm update` no longer replaces the specifier a project declares for
a dependency that is also listed in `overrides`. A `catalog:` reference
stays a `catalog:` reference, and a declared range stays as written,
instead of being rewritten to the version the override resolved to
[#&#8203;12115](https://redirect.github.com/pnpm/pnpm/issues/12115).

- `pnpm update` no longer moves the range a project declares for a
dependency that `overrides` also lists, even when the override repeats
that range verbatim. Previously the updated `package.json` disagreed
with the lockfile, so the next `pnpm install --frozen-lockfile` failed
with a specifier mismatch
[#&#8203;14224](https://redirect.github.com/pnpm/pnpm/issues/14224).

- Make `pnpm add --lockfile-only` skip dependency linking
[pnpm/pnpm#14286](https://redirect.github.com/pnpm/pnpm/issues/14286).

- `--production` is accepted again as an alias of `--prod` on `install`,
`fetch`, `prune`, `update`, `list`, `why`, and `sbom`, and the install
that `verifyDepsBeforeRun` reproduces is now spelled with `--prod`.
`pnpm run` no longer aborts with "unexpected argument '--production'
found" after a production-only install
[#&#8203;14147](https://redirect.github.com/pnpm/pnpm/issues/14147).

- The progress output no longer overwrites the lines above it once it
grows taller than the terminal window
[#&#8203;14270](https://redirect.github.com/pnpm/pnpm/issues/14270).

- Restoring a dependency's build from the remote side-effects cache no
longer downloads files the store already holds.

- Forward `patchedDependencies` hashes and `packageExtensions` to pnpr
so server-side resolution preserves patches and package extensions in
the lockfile and installed packages.

- Published the workspace task graph and scheduler as
`@pnpm/workspace.task-scheduler` so other workspace commands can use the
same dependency-aware scheduling as recursive run and exec.

- The environment variables for the remote side-effects cache are named
for the setting they configure: `PNPM_SIDE_EFFECTS_CACHE_REMOTE_KEY_ID`,
`..._BUILDER_ID`, `..._IMAGE_DIGEST`, `..._ARCHITECTURE_BASELINE`,
`..._PRIVATE_KEY`, `..._BUILD_ENV`, `..._TRUSTED_KEYS` and
`..._PUBLISH`. The `PNPM_REMOTE_SIDE_EFFECTS_CACHE_*` names keep
working, and the new one wins when both are set.

- A `devEngines.packageManager` range pin on pnpm is now recorded in
`pnpm-lock.yaml`'s `packageManagerDependencies` when the running pnpm
already satisfies it, using the running version and keeping the range as
the recorded specifier. Previously only an exact pin — or a range
resolved on the way through a version switch — reached the lockfile, so
a range pin written by hand (or by any tool other than `pnpm add` /
`pnpm self-update`) left the project without the shared resolution the
pin exists to provide.

- Fixed recursive `run` cleanup on Windows when a lifecycle script fails
while another script's process tree is still running.

- The update notification now suggests `pnpm self-update` when
`PNPM_HOME` manages the pnpm in use, and the [standalone install
script](https://pnpm.io/installation) otherwise — under Corepack, or
when another package manager installed pnpm. `pnpm self-update` under
Corepack names the standalone install script too.

- Enforce `allowBuilds` when a prepared git dependency is reused from
the shared store, and use the lockfile's canonical git resolution ID in
approval suggestions.

- Topologically sorting workspace projects now runs in linear time,
fixing installs and lockfile updates that stalled for seconds on
workspaces with thousands of projects forming deep dependency chains
[#&#8203;14149](https://redirect.github.com/pnpm/pnpm/issues/14149),
[#&#8203;14151](https://redirect.github.com/pnpm/pnpm/issues/14151).

<!-- sponsors -->

##### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"
/>
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

##### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on the first day of the month"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-03 14:29:56 +00:00
renovate[bot] de53e80efc chore(deps): update dependency oxfmt to ^0.66.0 (#26232) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.65.0` →
`^0.66.0`](https://renovatebot.com/diffs/npm/oxfmt/0.65.0/0.66.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.66.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.66.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.65.0/0.66.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.65.0/0.66.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.66.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.65.0...oxfmt_v0.66.0)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.65.0...oxfmt_v0.66.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-01 16:59:45 +00:00
renovate[bot] 2436b4407c chore(deps): update pnpm to v11.24.0 (#26203) 
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm))
| [`11.17.0` →
`11.24.0`](https://renovatebot.com/diffs/npm/pnpm/11.17.0/11.24.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.24.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/11.24.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/11.17.0/11.24.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.17.0/11.24.0?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v11.24.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.24.0):
pnpm 11.24

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.23.0...v11.24.0)

##### Minor Changes

- Added global build approvals
[pnpm/pnpm#14101](https://redirect.github.com/pnpm/pnpm/issues/14101).

##### Patch Changes

- Fixed pnpm v11 incorrectly reporting `confirmModulesPurge` as
unrecognized when set in `pnpm-workspace.yaml`. The Rust CLI now
identifies the unsupported option as a pnpm v11 setting instead of
suggesting an unrelated setting.

- `pnpm install --frozen-lockfile` no longer fails with
`ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE` when the pinned pnpm
version recorded in `pnpm-lock.yaml` has to be re-resolved before it can
be installed. It runs the pnpm version the lockfile pins and leaves the
lockfile unchanged
[#&#8203;14124](https://redirect.github.com/pnpm/pnpm/issues/14124).

- Under `nodeLinker: hoisted`, peer-resolution variants of an injected
directory dependency (a `file:` snapshot) are materialized as separate
copies again instead of collapsing onto the first-seen variant. Each
copy keeps its own peer-resolved dependency set, so a project pinning
one peer version no longer resolves another project's variant — Bit root
components with conflicting peers across injected copies rely on this.

- Fixed `pnpm install --merge-git-branch-lockfiles --frozen-lockfile`
failing with `ERR_PNPM_OUTDATED_LOCKFILE` when a branch lockfile
predates the removal of a dependency, or its move to another dependency
group
[#&#8203;13966](https://redirect.github.com/pnpm/pnpm/issues/13966). A
dependency that no project declares anymore is no longer reinstated by
the merge, and the packages it was the only path to are dropped with it.

- Batch workspace publishing accepts a shared scope-specific credential,
rejects mismatched credentials for a registry before publishing, and
runs the `publish` and `postpublish` scripts after each completed
registry group
[pnpm/pnpm#14101](https://redirect.github.com/pnpm/pnpm/issues/14101).

- The Rust CLI now honors five settings it recognized but ignored:
`updateNotifier`, `legacyDirFiltering`, `initAuthorName` /
`initAuthorEmail` / `initAuthorUrl`, `initLicense`, and `initVersion`.
`pnpm install` and `pnpm add` check once a day for a newer pnpm and
print how to get it (turn it off with `updateNotifier: false`); a
`{<dir>}` filter selector can go back to matching the subtree below the
directory with `legacyDirFiltering: true`; and `pnpm init` writes the
configured author, license, and version into the `package.json` it
scaffolds. `PNPM_CONFIG_INIT_VERSION` is now read as well.

`maxsockets`, npm's spelling of `maxSockets`, is no longer ignored: both
spellings are read from `pnpm-workspace.yaml`, the global config file,
the environment, and the command line, in that increasing order of
precedence — a value passed on the command line now wins even when the
two sides spelled the setting differently.

A `lastUpdateCheck` timestamp dated in the future — after a clock
change, a restored snapshot, or a hand-edited state file — no longer
silences the update check until that time comes around.

`legacyDirFiltering` no longer reaches the workspace-root selectors pnpm
generates for itself: the `!{<workspace-root>}` exclusion a recursive
`run` / `exec` / `add` / `test` appends, and the `{<workspace-root>}`
inclusion `--workspace-root` appends. Read as subtree matches they named
every project below the root, so a recursive command under the setting
selected nothing at all, and `--workspace-root` pulled in every project
below the root instead of the root alone
[#&#8203;14101](https://redirect.github.com/pnpm/pnpm/issues/14101).

- `pnpm install --frozen-lockfile` no longer fails when `pnpm-lock.yaml`
records the pinned pnpm version alongside an engine package the running
pnpm does not install it from. An entry pinning another version is still
refused, and a plain install rewrites the block
[#&#8203;14124](https://redirect.github.com/pnpm/pnpm/issues/14124).

###
[`v11.23.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.23.0):
pnpm 11.23

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.22.0...v11.23.0)

#### Minor Changes

- `pnpm config get` and `pnpm config list` now show the settings pnpm
acts on under their documented names:

- `registries` shows the registries pnpm resolves from, merged across
every source (`.npmrc`, `pnpm-workspace.yaml`, the global config, CLI
flags), in the shape the setting is written in: keyed by registry URL,
with the default registry declared as the bare `@` scope. Built-in
routes are included — the `@jsr` scope and the `npmjs` and `gh` prefixes
— unless pointed elsewhere. Previously `pnpm config get registries`
printed `undefined`.
- `update` and `audit` show the effective sections, whichever spelling
set them. The deprecated internal spellings (`updateConfig`,
`auditConfig`, `auditLevel`) are no longer listed.
- `catalogs` shows the complete resolved catalog set — the singular
`catalog` block is its `default` entry — whichever spelling declared it.
- The `registry` and `@scope:registry` entries show the merged routes
rather than raw `.npmrc` values, so they always agree with the
`registries` view.

- Settings that no supported pnpm version recognizes get their own
warning. A key in the global config file that this version of pnpm does
not read is no longer reported with advice to move it to a project-level
`pnpm-workspace.yaml` (where it would be ignored too); the warning now
says the setting is not recognized by this version of pnpm, names the
pnpm version that does read it when there is one (for example,
`globalShims` is a pnpm v12 setting), and suggests the closest real
setting name when the key looks like a typo. Unrecognized and
non-camelCase keys in a project's `pnpm-workspace.yaml`, previously
ignored silently, are now reported the same way. `pnpm config get <key>`
and `pnpm get <key>` no longer print config-load warnings, so a script
capturing the value gets the value alone.

- The `importPackage` pnpmfile hook is deprecated. pnpm now prints a
warning when a pnpmfile defines it, and the hook will be removed in the
next major version. It also opts the installation out of the parallel
package importer, making installation slower. If you rely on this hook,
comment on
[#&#8203;14101](https://redirect.github.com/pnpm/pnpm/issues/14101).

- `node_modules/.modules.yaml` no longer records the registries an
install resolved from, and the recorded copy is dropped from the file on
the first install that rewrites it.

It dated from the lockfile format that spelled a dependency's path
relative to its registry, where reading an installed tree meant knowing
the registries it was installed with. Dependency paths have not carried
a registry for several major versions, and the recorded copy outlived
its use: `pnpm list`, `pnpm why`, and single-project installs preferred
it over the project's own configuration, so a project whose registry had
changed since its last install was still read through the old one.

They now use the configured registries, like every other command already
did.

- When `enableGlobalVirtualStore` is on, every process pnpm spawns for
the project (`pnpm run`, `pnpm exec`, lifecycle scripts) now receives a
`NODE_PATH` pointing at the project's hoisted `node_modules`, plus a
`NODE_OPTIONS` `--import` flag that registers a resolve hook restoring
`NODE_PATH` lookups for ESM imports. Dependencies that import undeclared
("phantom") packages keep resolving under the global virtual store — for
both CommonJS and ESM — without installing the
`@pnpm/plugin-esm-node-path` config dependency
[pnpm/pnpm#9618](https://redirect.github.com/pnpm/pnpm/issues/9618).
Tools run by `pnpm dlx` resolve such dependencies too: the JS CLI passes
them the same environment, while the Rust CLI's dlx cache is
self-contained, so its layout already exposes them.

- A registry can now declare that its abbreviated metadata carries the
`time` field, so `resolutionMode: time-based` reads the full metadata
document only from the registries that need it:

  ```yaml
  resolutionMode: time-based
  registries:
    https://npm.internal.example/:
      supportsTimeField: true
  ```

`registry.npmjs.org` omits `time` from abbreviated metadata, so a
time-based resolution has to fall back to the much larger full document.
That fallback used to be all-or-nothing: `registrySupportsTimeField`
answered for every registry at once, so a project resolving from both
the public registry and a Verdaccio instance either paid for full
metadata everywhere or claimed a `time` field npmjs does not serve. The
answer is now per registry, and `registrySupportsTimeField` remains the
answer for every registry that does not declare one.

The declaration is also sent to a pnpr server, which applies it to the
resolution it runs on the client's behalf.

- A pnpr resolve request now carries the client's registries the way the
`registries` setting declares them — keyed by URL, with the scopes
routed to each, the bare-specifier prefix each answers to, and each
one's `serverType` — in place of the prefix map it used to send.

The server routes them through the same inversion the config reader
runs, so a pnpr-served install resolves a scoped dependency from the
registry that scope is routed to, which it previously could not: only
the default registry and the prefix-addressed ones reached the server. A
declared `serverType` reaches it too, so the tarball URLs pnpr omits
from the lockfile match the ones the client reconstructs.

Built-in scope routes the project has not pointed elsewhere are not
declared, so a pnpr server's allowlist is not asked about `npm.jsr.io`
on requests that resolve no JSR package.

A registry a request only declares is no longer refused up front for
being off the server's allowlist — a client describes its whole
configuration, including scopes a given resolve never reaches, so a
stray `@scope:registry` in a developer's `~/.npmrc` no longer fails
every install against a pnpr server that does not serve it. The boundary
moves to the fetch itself: an origin the resolve does reach is refused
before the request leaves the server, with the same message.

This changes the resolve and verify-lockfile request bodies. A pnpr
server and its clients have to be on matching versions; the protocol is
still experimental and unversioned.

- The `registries` setting now declares a registry once, keyed by its
URL, with everything about that registry in the entry: how it lays out
tarball URLs, the scopes routed to it, and the bare-specifier prefix it
answers to.

  ```yaml
  registries:
    https://artifactory.example.com/artifactory/api/npm/npm-virtual/:
      serverType: artifactory
      scopes: ['@acme', '@acme-internal']
      prefix: work
  ```

- **`serverType`** tells pnpm how the registry lays out its tarball
URLs, which decides whether a URL can be omitted from `pnpm-lock.yaml`:
- **undeclared** (the default) — strict. Only the exact canonical URL is
treated as reconstructible.
- **`npm`** — the registry behaves like `registry.npmjs.org`, which also
serves a scoped package from its percent-encoded path. Declare this for
a faithful mirror or caching proxy of the public registry so its tarball
URLs can be omitted too.
- **`artifactory`** — JFrog Artifactory repeats the scope in a scoped
package's tarball filename (`@acme/widget/-/@acme/widget-1.0.0.tgz`)
where the npm registry strips it (`@acme/widget/-/widget-1.0.0.tgz`).
Declaring it lets pnpm rebuild that URL, so it is omitted from
`pnpm-lock.yaml` instead of being written out for every scoped package
[pnpm/get-npm-tarball-url#16](https://redirect.github.com/pnpm/get-npm-tarball-url/issues/16).
- **`scopes`** lists the `@`-prefixed scopes that resolve from this
registry. A bare `'@'` is the scope-less default registry, the one the
`registry` setting names.
- **`prefix`** is the alias a dependency addresses this registry by, as
in `"foo": "work:^1.0.0"`.

The layout is never inferred from the registry URL, so nothing changes
unless you declare it; `registry.npmjs.org` continues to behave as `npm`
without being declared. Because the lockfile depends on `serverType`, it
is read from `pnpm-workspace.yaml` only — a `serverType` in the global
`config.yaml` is ignored, so one developer's machine cannot shape a
lockfile their collaborators read back with a different layout.
Credentials are rejected in this setting, in a key as well as in a
field, and still belong in `.npmrc`. An entry that routes nothing to
itself and matches no configured registry is reported as a warning
rather than silently ignored.

##### Migrating

The older `registries` shape, a map of `<scope>: <url>` strings, still
works and needs no change:

```yaml
registries:
  '@acme': https://npm.acme.example/
```

`namedRegistries` is deprecated in favor of the `prefix` field, and is
still read for prefixes `registries` does not declare.

`toLockfileResolution` and `isCanonicalRegistryTarballUrl` now take
their registry and layout as an options object rather than positional
arguments, so `@pnpm/lockfile.utils` and `@pnpm/resolving.tarball-url`
get a major bump.

- An install that had to re-hash store files to verify them now reports
it. If that cost more than a second, it says how long — `The integrity
of N files was checked in 2.5s.` — and if it was quick but covered more
than a thousand files, it names the cause instead: their timestamps
changed since the store recorded them, which a backup tool, an antivirus
scan or a copied store can do.

- Added `virtualStoreType`, which names where the virtual store lives —
one store per machine, or one per project:

  ```yaml
  virtualStoreType: global   # or: project
  ```

It is the canonical spelling of `enableGlobalVirtualStore`, which keeps
working. When a project sets both, `virtualStoreType` wins. It can also
be set through `PNPM_CONFIG_VIRTUAL_STORE_TYPE` and read back with `pnpm
config get virtualStoreType`. The default is unchanged — `project`, so
the shared store stays opt-in.

The setting is independent of `nodeLinker`. `isolated` and `pnp` both
work with either store type, and `hoisted` writes no virtual store at
all, so it is unaffected.

#### Patch Changes

- `pnpm add --allow-build` now adds to the `allowBuilds` entries already
in `pnpm-workspace.yaml` instead of replacing them
[#&#8203;13872](https://redirect.github.com/pnpm/pnpm/issues/13872).

- Kept pending build approvals available after removing an unrelated
dependency.

- `pnpm approve-builds` now removes `onlyBuiltDependencies`,
`onlyBuiltDependenciesFile`, `neverBuiltDependencies`, and
`ignoredBuiltDependencies` from `pnpm-workspace.yaml` when it writes
`allowBuilds`. Those settings were replaced by `allowBuilds` in pnpm 11
and silently ignored since, so a workspace migrated from pnpm 10 kept
them around looking active.

- `pnpm audit` no longer reports a patched version that was never
published or is deprecated. The inferred patched range (e.g. `>=4.17.24`
from `<=4.17.23`) is now checked against the registry packument, and the
report is corrected to the lowest non-deprecated published version that
satisfies it (e.g. `>=4.18.1` when `4.17.24` does not exist and `4.18.0`
is deprecated). When no published version satisfies the range, the
report shows `Patched versions: None`. This also prevents `pnpm audit
--fix` from adding overrides or `minimumReleaseAgeExclude` entries for
patches that do not exist
[#&#8203;13824](https://redirect.github.com/pnpm/pnpm/issues/13824).

`pnpm audit --fix` and `pnpm audit --fix update` no longer add a
`minimumReleaseAgeExclude` entry when the registry packument shows that
the minimum patched version was never published. Previously such entries
were written for versions that do not exist, which would have let a
later publish of that version bypass the `minimumReleaseAge` gate
[#&#8203;11563](https://redirect.github.com/pnpm/pnpm/issues/11563).

The `--json` output of `pnpm audit` now returns `patched_versions: null`
for advisories whose inferred patch is not available (never published,
skipped, yanked, or deprecated), making it easier for tooling to
distinguish "no fix available" from "fix available at version X".

- Fixed `pnpm patch-commit` in project and edit paths containing
non-ASCII characters.

- The package and bump pickers of `pnpm change` now size their page from
the terminal height instead of always showing 7 rows. They fall back to
7 rows when the terminal height is unknown
[`pnpm/pnpm#13815`](https://redirect.github.com/pnpm/pnpm/issues/13815).

- Canceling a `pnpm change` prompt with Ctrl-c no longer prints a stack
trace. It reports `Change canceled` and exits with a success status,
like the other interactive commands
[#&#8203;13814](https://redirect.github.com/pnpm/pnpm/issues/13814).

- Re-fetch full registry metadata when `minimumReleaseAge` is enabled
and an abbreviated packument's `time` map omits timestamps for some
versions. This prevents mature versions from being filtered out and
resolution from falling back to the lowest matching version
[pnpm/pnpm#13741](https://redirect.github.com/pnpm/pnpm/issues/13741).

- A config dependency carrying an inline integrity (the
`<version>+<integrity>` form, or the object form without a `tarball`)
now takes its tarball URL from the registry's packument instead of
deriving it from the registry URL, so migrating one costs an extra
metadata request. On a registry that serves tarballs from a path pnpm
cannot derive, GitLab's group endpoint for one, installing such a config
dependency failed with a 404 while the same package installed fine as a
regular dependency
[#&#8203;13765](https://redirect.github.com/pnpm/pnpm/issues/13765).

- Fixed `PNPM_CONFIG_NODE_VERSION` being ignored when setting the
Node.js version used for compatibility checks.

- A custom fetcher can no longer replace the archive integrity that
`pnpm-lock.yaml` pins: the locked value is restored after a `canFetch`
or `fetch` hook rewrites the resolution, and delegating a locked archive
to a directory or git source now fails instead of installing unverified
content.

The Rust CLI now also loads the pnpmfiles named by the `pnpmfile`
setting (a single path or an ordered list), and hands custom fetchers
native `localTarball` and `remoteTarball` callbacks — including on a
fresh install that has to compute a missing tarball integrity, which is
then reused by later offline installs. File maps a fetcher returns are
accepted only when they match what those native callbacks extracted.

- Fixed an issue where running `pnpm dedupe --check` in projects with
`nodeLinker: hoisted` would cause dependencies to be moved out of
`node_modules` into `node_modules/.ignored`.

- `pnpm deploy --prod` and `pnpm deploy --no-optional` no longer list
the excluded dependency groups in the deployed `package.json` and
`pnpm-lock.yaml`. The deployed lockfile referenced packages that the
deploy left out of its graph, so installing in the deploy directory
afterwards created dangling symlinks
[#&#8203;13623](https://redirect.github.com/pnpm/pnpm/issues/13623).

- Don't treat files like `license16.json` as a package license when
deciding if the workspace LICENSE file should be included in the packed
package.

- `pnpm exec --recursive --no-reporter-hide-prefix` no longer prints a
blank prefixed line after each chunk of a command's output, and no
longer splits a line in two when it straddles a chunk boundary.

- Fixed `404` errors when installing from a registry that serves scoped
packages only from a percent-encoded path, such as GitHub Enterprise
Server. Outside `registry.npmjs.org`, a tarball URL that encodes the
scope separator as `%2f` or `%2F` is no longer mistaken for one that
pnpm can rebuild from the package name, version, and registry, so it is
kept in `pnpm-lock.yaml` and requested verbatim on the next install
[#&#8203;13534](https://redirect.github.com/pnpm/pnpm/issues/13534).

- Fixed `trustPolicyExclude` and `minimumReleaseAgeExclude` being
ignored when set to a single string instead of a list. The value was
read one character at a time, so the exclusion never matched the package
it named — and a `*` anywhere in it matched every package, silently
switching the policy off.

- `pnpm init` now pins the exact pnpm version instead of a `^` range,
and records it in the `packageManager` field alongside
`devEngines.packageManager`. Corepack reads only `packageManager` and
accepts nothing but an exact version, so it rejected the generated
`package.json` with "expected a semver version"
[pnpm/pnpm#13969](https://redirect.github.com/pnpm/pnpm/issues/13969). A
package created inside an existing workspace is still left unpinned — it
follows the pin at the workspace root — and `--no-init-package-manager`
still scaffolds a manifest without any pin. In pnpm 12, `pnpm init` also
honors `initType` and its `--init-type` flag, so the manifest it writes
is the same one pnpm 11 writes.

- Fixed an issue where package overrides were written into the metadata
cache, causing removed overrides to keep applying on subsequent installs
[pnpm/pnpm#13918](https://redirect.github.com/pnpm/pnpm/issues/13918).

- On Windows, upgrading pnpm no longer leaves a stale `pnpm.ps1` behind.
PowerShell resolves `pnpm.ps1` ahead of `pnpm.cmd`, so a shim written by
an older installation kept running the previous version. Linking the
pnpm CLI's bins now deletes it
[#&#8203;13919](https://redirect.github.com/pnpm/pnpm/issues/13919).

- Fixed an inconsistency where `minimumReleaseAgeExclude` (and
`trustPolicyExclude`) wildcard/bare-name rules behaved differently in
the evaluator and normalizer. A bare rule now consistently evaluates as
matching every version, preventing unexpected behavior and silent
widening of version policy exemptions when pnpm rewrites the workspace
manifest
[pnpm/pnpm#13725](https://redirect.github.com/pnpm/pnpm/issues/13725).

- A frozen install no longer rewrites the `packageManagerDependencies`
block of `pnpm-lock.yaml`. When the pnpm version pinned by
`devEngines.packageManager` (or by `packageManager`) is missing from the
lockfile or no longer matches it, `--frozen-lockfile` now fails with
`ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE` instead of resolving
the version and saving it, so a manifest whose pin was bumped without
regenerating the lockfile can no longer pass CI
[#&#8203;14009](https://redirect.github.com/pnpm/pnpm/issues/14009).

- A git dependency installed over HTTPS from a hosted repository now
keeps its branch, tag, or version range in the specifier recorded in
`package.json`. It was written back without one, so the next `pnpm
update` moved the dependency to the repository's default branch
[#&#8203;13999](https://redirect.github.com/pnpm/pnpm/issues/13999).

- Fixed `pnpm update --global --latest` failing with a 404 error when a
globally installed package was not added from the registry by name.
Packages installed from a local path (`link:`/`file:`), a git
repository, a tarball URL, an `npm:` alias, or a named registry now keep
their spec during a global update instead of being looked up by name in
the default registry. See
[#&#8203;12854](https://redirect.github.com/pnpm/pnpm/issues/12854).

- Fix recursive `pnpm update <name>@<version>` so an exact pinned update
stays scoped to the requested version line: copies of the same package
on another major line — or, for a `0.x` request, another minor line —
keep their locked resolution instead of being re-resolved along with the
target.

- Under `nodeLinker: hoisted`, a dependency declared against a
peer-resolution variant of a package version is no longer dropped from
the installed layout. All variants of a version share one hoisted copy,
and edges pointing at any of them now resolve to it, so the depending
project keeps the package in its `.package-map.json` and the depending
package keeps it in its `node_modules/.bin`.

- Fixed `pnpm install --merge-git-branch-lockfiles` deleting the
per-branch lockfiles when the `lockfile` setting is `false`. Such an
install never reads them, so it has nothing to merge them into and now
leaves them alone.

- Fixed `pnpm install` sometimes not exiting after printing `Done in Xs`
[#&#8203;12297](https://redirect.github.com/pnpm/pnpm/issues/12297).

- Fixed pnpm failing to read `.modules.yaml` files containing long
dependency paths
[#&#8203;13875](https://redirect.github.com/pnpm/pnpm/issues/13875). The
manifest is now parsed as JSON (the format pnpm writes it in), falling
back to the YAML parser only for manifests written by old pnpm versions.

- With `preferSymlinkedExecutables`, `NODE_PATH` again points at the
virtual store of the workspace root when pnpm is run from inside a
workspace package, so scripts can resolve dependencies that live only in
the hoisted store
[#&#8203;13912](https://redirect.github.com/pnpm/pnpm/issues/13912).

- Reduced registry metadata requests during dependency resolution by
reusing cached metadata when lockfile preferences prove that no uncached
version can win
[pnpm/pnpm#13976](https://redirect.github.com/pnpm/pnpm/issues/13976).

- `pnpm pkg get` and `pnpm pkg set` now accept hyphens inside a
dot-notation property path, so `pnpm pkg get
dependencies.some-package-name` reads the key instead of failing with
`ERR_PNPM_UNEXPECTED_TOKEN_IN_PROPERTY_PATH`. The bracketed and quoted
forms already worked and are unchanged.

- A resolve request now carries the client's `resolutionMode`, so an
install delegated to a pnpr server picks versions the way the client
would. `time-based` and `lowest-direct` reached the server as nothing at
all, leaving it on its `highest` default: the returned lockfile pinned
the highest satisfying version of every dependency, and the setting
appeared to be ignored.

This adds a field to the resolve request body. A server older than its
client ignores it and keeps resolving `highest`; the protocol is still
experimental and unversioned.

- Fixed `pnpm` installs using pnpr to honor the client's
`autoInstallPeers`, `dedupePeers`, and `excludeLinksFromLockfile`
settings
[pnpm/pnpm#13389](https://redirect.github.com/pnpm/pnpm/issues/13389).

- `pnpm remove` now prunes undecided entries (`"set this to true or
false"`) from `allowBuilds` in `pnpm-workspace.yaml` when
`sharedWorkspaceLockfile: true` and the corresponding packages are
removed
[pnpm/pnpm#13892](https://redirect.github.com/pnpm/pnpm/issues/13892).

- Fixed workspace discovery for `pnpm-workspace.yaml` files without a
`packages` field so commands only consider the workspace root instead of
recursively scanning nested projects
[#&#8203;14047](https://redirect.github.com/pnpm/pnpm/issues/14047).

- A runtime installed through `devEngines.runtime` now matches the host
when `supportedArchitectures` lists several platforms. Listing `os:
[darwin, linux]` and `cpu: [x64, arm64]` used to install the runtime
built for the first entry of each list, so a machine running Linux on
arm64 got a macOS x64 Node.js that could not execute
[#&#8203;13898](https://redirect.github.com/pnpm/pnpm/issues/13898).

- `pnpm sbom` now fails with `ERR_PNPM_SBOM_MISSING_IMPORTERS` when
`pnpm-lock.yaml` has no entry for a selected project, instead of writing
an SBOM that under-reports that project's dependencies. Previously this
crashed with `Cannot read properties of undefined (reading
'devDependencies')`.

- `pnpm self-update` now rewrites a simple
`devEngines.packageManager.version` range (`^`/`~`) to the newly
installed version, keeping the operator — matching how `pnpm update` and
`pnpm runtime set` rewrite ranges. Complex ranges such as `>=8.0.0` that
the new version satisfies are still left unchanged
[#&#8203;13935](https://redirect.github.com/pnpm/pnpm/issues/13935).

- `pnpm self-update <tag>` no longer downgrades when the dist-tag points
at the pnpm version already running and that version is younger than
`minimumReleaseAge`. The maturity cutoff moved the tag back to the
previous mature release, so `pnpm self-update next-12` on v12.0.0-rc.4
switched to v12.0.0-rc.3.

- `pnpm set-script` now updates `package.json` instead of failing with
`ERR_PNPM_NOT_IMPLEMENTED`
[`pnpm/pnpm#13956`](https://redirect.github.com/pnpm/pnpm/issues/13956).

- `pnpm update` now preserves the existing range operator when updating
a prerelease dependency. See
[#&#8203;7002](https://redirect.github.com/pnpm/pnpm/issues/7002).

- Installs are faster in workspaces that declare inter-workspace
dependencies with plain ranges (`"*"`, `"^1.2.3"`) rather than the
`workspace:` protocol. With `preferWorkspacePackages` enabled, linking
such a dependency no longer makes a registry request that cannot change
the outcome — and workspace packages that were never published no longer
cost a 404 on every install.

- Added `fetchWarnTimeoutMs` and `fetchMinSpeedKiBps` to the Rust pnpm
CLI and its N-API bindings. Slow registry metadata requests and tarball
downloads now emit pnpm-compatible warnings without exposing URL
credentials, query parameters, fragments, or control characters
[pnpm/pnpm#12042](https://redirect.github.com/pnpm/pnpm/issues/12042).

- An override change is now absorbed by the fast lockfile update even
when another, unchanged override uses the `catalog:` protocol.
Previously any `catalog:`-valued override forced a full re-resolution
whenever the override list changed, which could move unrelated packages
in the lockfile (for example after `pnpm audit --fix` added an
override).

- Packed workspace package manifests now preserve dependency order,
making repeated `pnpm pack` output deterministic
[#&#8203;10167](https://redirect.github.com/pnpm/pnpm/issues/10167).

- `pnpm update <name>@<version>` now fails with
`ERR_PNPM_UPDATE_VERSION_ON_INDIRECT_DEP` when the package is not a
direct dependency of any selected project, instead of quietly updating
it to whatever a fresh install would resolve. There is nowhere to record
the version in that case, so the request cannot be honored, and the
error points at the `overrides` entry that does pin a transitive
dependency. Ranges and tags are unaffected, and a package that any
selected project declares directly still takes its version as before.

- `trustPolicy: no-downgrade` no longer aborts the install with
`ERR_PNPM_MISSING_TIME` on registries that serve no per-version `time`
field when `minimumReleaseAgeIgnoreMissingTime` is set. The trust check
reads the same publish dates the `minimumReleaseAge` check does, so it
now honors the same opt-in and skips the affected package with a warning
[#&#8203;12446](https://redirect.github.com/pnpm/pnpm/issues/12446).

`minimumReleaseAgeIgnoreMissingTime` no longer lets a lockfile entry the
registry does not list pass the `minimumReleaseAge` check during
lockfile verification. The opt-in covers a registry that cannot date its
releases; a packument that does date every version it lists is saying it
never published this one, which stays a hard failure.

The missing-`time` warning now names the check it is reporting on, so a
package whose `minimumReleaseAge` and `trustPolicy` checks are both
skipped warns about both instead of only the first.

- `pnpm update <pkg>@<version>` now updates only the selected packages
and leaves unrelated dependencies unchanged. A selector that renames the
package it installs — `pnpm update <alias>@npm:<pkg>@<version>` or the
`jsr:` equivalent — now targets the package the alias installs rather
than the alias.

- Fixed `verifyDepsBeforeRun` being ignored when set to `install`,
`warn`, `error`, or `prompt` through the
`PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN` environment variable or the
`--config.verify-deps-before-run` flag
[#&#8203;13816](https://redirect.github.com/pnpm/pnpm/issues/13816).
Only the boolean values were accepted before, so a string value was
silently dropped.

- `pnpm version <bump>` with `--dry-run` no longer edits `package.json`
files. It now only reports the bumps it would make, and skips the
working tree check, the version lifecycle scripts, the commit, and the
tag
[`pnpm/pnpm#13953`](https://redirect.github.com/pnpm/pnpm/issues/13953).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v11.22.0`](https://redirect.github.com/pnpm/pnpm/compare/v11.21.0...v11.22.0)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.21.0...v11.22.0)

###
[`v11.21.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.21.0):
pnpm 11.21

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.20.0...v11.21.0)

#### Minor Changes

- Added interactive group selection to `pnpm update --global
--interactive`.

- Running `pnpm setup`, `pnpm self-update`, or a command that modifies
the global installation (such as `pnpm add --global`) through `sudo` now
prints a warning. pnpm keeps global packages and configuration in the
invoking user's home directory, so running these commands as root
silently operates on the root user's home directory instead of yours.
They will fail with `ERR_PNPM_SUDO_NOT_SUPPORTED` in pnpm v12. Read-only
global commands (such as `pnpm bin --global`) are unaffected.

#### Patch Changes

- Fixed pnpm failing to start under asynchronous Node.js module loaders
when no `.pnpmfile.mjs` exists
[pnpm/pnpm#11701](https://redirect.github.com/pnpm/pnpm/issues/11701).

- Fixed `minimumReleaseAge` fallback for custom dist-tags so the
selected version does not exceed the registry’s original tag target.

- Removing a dependency from `package.json` and reinstalling no longer
re-resolves the dependency graph. The importer's entry is dropped from
`pnpm-lock.yaml`, anything it made unreachable is pruned, and a catalog
entry that loses its last referent is removed — all without registry
access. Installs still fall back to a full resolution when a package
that stays resolves a peer dependency through the removed one, since
that would change the surviving package's entry rather than only prune.

- Changing a catalog entry to a different exact version no longer
re-resolves the dependency graph. The package is replaced in
`pnpm-lock.yaml` directly, reusing the same check the `pnpm.overrides`
fast path applies: every locked dependency of the package must still
satisfy the new version's manifest. Installs fall back to a full
resolution when anything other than the catalog reaches the package — an
importer that depends on it directly, or another package that depends on
it — since the graph would then need both versions.

- Fixed a CI regression where `github:owner/repo` dependencies (and
other shorthand Git specifiers) would fail to install with `Permission
denied (publickey)` on CI runners that lack SSH keys. The Git resolver
no longer records an SSH URL unless the user explicitly wrote one (e.g.
`git+ssh://` or `git@host:...`):

- The repository visibility probe (an HTTP HEAD request) now retries
transient failures such as `429 Too Many Requests`, so host throttling
of CI runners is no longer mistaken for a private repository.
- For non-SSH specifiers, anonymous HTTPS `git ls-remote` access is now
tried before SSH, so a public repository whose visibility probe fails
still resolves to a portable HTTPS URL instead of an SSH URL that only
works where SSH keys are configured.
- When every probe fails, the resolver falls back to HTTPS for shorthand
and HTTPS-style specifiers, and only guesses SSH when the user
explicitly provided an SSH URL.
- A repository that could not be confirmed public is no longer resolved
to the host's anonymous archive URL (e.g. `codeload.github.com`, which
would fail to download for a private repository); it stays a regular
`git` resolution so installs can use ambient Git credentials such as
credential helpers and tokens.

Note that a private repository that is reachable both over authenticated
HTTPS and over SSH now resolves to its HTTPS URL, where previous
versions recorded the SSH URL.

Fixes
[pnpm/pnpm#13276](https://redirect.github.com/pnpm/pnpm/issues/13276).

  <!-- cspell:ignore publickey -->

- `ng build` and `nuxt build` now work under the global virtual store:
pnpm's built-in compatibility extensions add the `tslib` dependency that
`@angular/build` uses without declaring and the `unplugin` dependency
that `@nuxt/vite-builder` v4 uses without declaring.

- Fixed `link:` dependencies under `enableGlobalVirtualStore` so linked
children are materialized and slots remain isolated by their resolved
link targets.

- An install that skips resolution because `pnpm-lock.yaml` is already
up to date now reacts fully to packages the lockfile removed — for
example after pulling a lockfile in which a dependency was deleted. The
hoist layer is recomputed, so a package that became hoistable when a
direct dependency was removed is hoisted, and `pendingBuilds` entries
for removed packages are dropped instead of staying pending forever.

- The held-back-update warning printed by `pnpm update` no longer fires
when `minimumReleaseAge` is the actual reason a newer version was not
picked. The warning's baseline now applies the same maturity cutoff as
the pick itself, so it no longer wrongly attributes the hold-back to
"your manifests and already installed dependencies" or recommends an
override that would defeat the age gate. See
[#&#8203;13071](https://redirect.github.com/pnpm/pnpm/issues/13071).

- Checking whether `ignoredOptionalDependencies` is up to date no longer
reorders the configured patterns. The check sorted them in place, which
could move an `!` exclusion ahead of the pattern it excludes from and
flip which optional dependencies were ignored.

- Changing `autoInstallPeers`, `dedupePeers`, `peersSuffixMaxLength`,
`excludeLinksFromLockfile`, or `injectWorkspacePackages` no longer
re-resolves the dependency graph when the lockfile proves the setting
cannot affect it: no package or project declares a peer dependency for
the peer settings, and no project depends on a directory or on another
workspace project for the link and injection settings. The new setting
is recorded in `pnpm-lock.yaml` and the install proceeds from the
existing resolution. Every other case still falls back to a full
resolution.

- Adding, editing, or removing an entry in `patchedDependencies` no
longer re-resolves the dependency graph. Resolution never reads a patch
— it only records the patch file's hash against the package it matches —
so the install now rewrites the affected entries in `pnpm-lock.yaml` and
materializes the patched package from the store instead. Installs still
fall back to a full resolution when the patched package is reachable as
a peer dependency, and when the new configuration would leave a patch
unused while `allowUnusedPatches` is off, so `ERR_PNPM_UNUSED_PATCH` is
still reported.

- Resolving a private git repository no longer blocks on an interactive
credential prompt: `git ls-remote` now fails fast with an authentication
error when git has no credentials for the repository
[#&#8203;13522](https://redirect.github.com/pnpm/pnpm/issues/13522).

- Lockfile verification now honors offline mode by using cached registry
metadata instead of reaching the registry. When the required metadata is
not available locally, verification reports the same
`ERR_PNPM_NO_OFFLINE_META` condition used by offline resolution.

- POSIX shell shims now follow symbolic links before computing
`basedir`, preventing execution failures when a shim is invoked via an
external symlink on `PATH`
[#&#8203;13405](https://redirect.github.com/pnpm/pnpm/issues/13405).

- The automatic `packageManager` version switch works again on
registries whose tarball URLs point at a different host than the
registry itself (load-balanced feed proxies, Artifactory-style mirrors).
Package-manager entries are now always recorded with integrity-only
resolutions — the download URL is derived from the trusted bootstrap
registry instead — and entries persisted in an invalid shape by an
earlier pnpm are discarded and re-resolved instead of failing every
command
[#&#8203;13619](https://redirect.github.com/pnpm/pnpm/issues/13619).

- Registries that serve no npm signature metadata (private mirrors and
feed proxies commonly strip `dist.signatures`) no longer break the
automatic `packageManager` version switch and `pnpm self-update`
[#&#8203;13147](https://redirect.github.com/pnpm/pnpm/issues/13147).
When the configured registry cannot provide a verifiable signature, pnpm
now fetches the signature from `registry.npmjs.org` and verifies it
against the same embedded npm keys over the installed integrity — which
proves exactly the same thing. If no signature can be obtained from
either source (for example, both are unreachable, or the registry
publishes only a `shasum`), pnpm proceeds with a warning instead of
failing, but only when the packages resolve through a registry
configured in the user's own (non-project) configuration; the download
stays pinned by the lockfile integrity, and a signature that exists but
does not validate still fails the switch.

- `pnpm fetch`, and any install run with `virtualStoreOnly`, no longer
writes a `.pnp.cjs` loader under `nodeLinker: pnp`. These installs
populate the virtual store without linking the project, so the loader
would have claimed the project resolves out of a store it was never
linked into. The importer links and `node_modules/.package-map.json`
were already skipped; the PnP loader now follows the same rule.

- Prevent pnpm from removing project files when `modulesDir` resolves to
the project root.

- Speed up installs after adding `ignoredOptionalDependencies` patterns
by removing newly ignored optional dependencies and pruning packages
that are no longer reachable without resolving the dependency graph
again.

- When a failed install re-copies a bin script from the store, rerunning
`pnpm install` now reapplies the executable bit to the bin instead of
leaving it non-executable
[#&#8203;12742](https://redirect.github.com/pnpm/pnpm/issues/12742).

- `pnpm root -g` and `pnpm bin -g` now print warnings to stderr instead
of stdout, so their stdout stays a clean, machine-readable path.
Previously, running either command with `--global` in a project that
pins a package manager (e.g. via the `packageManager` field) printed a
warning like `[WARN] Using --global skips the package manager check for
this project` ahead of the path, breaking programs that capture the
output as a path
[#&#8203;13672](https://redirect.github.com/pnpm/pnpm/issues/13672).

In pnpm 12, `pnpm root -g` and `pnpm prefix -g` are now supported (they
previously failed with `ERR_PNPM_CLI_ROOT_GLOBAL_UNSUPPORTED` /
`ERR_PNPM_CLI_PREFIX_GLOBAL_UNSUPPORTED`), and the reporter output of
`dlx`, `create`, `config`, `sbom`, `with`, `store`, `prefix`, `root`,
and `bin` goes to stderr, matching pnpm 11.

- `pnpm setup` no longer makes Node.js print a
`MODULE_TYPELESS_PACKAGE_JSON` warning about `dist/worker.js` on every
command. The `package.json` it writes next to a standalone executable
now declares `"type": "module"`.

- `pnpm update` without saving no longer records a version that the
manifest's range excludes. The kept range stays authoritative: a
requested version outside it is skipped with a warning, and a requested
range, a dist tag, or `--latest` resolves within it instead of past it.
Previously each of these could write a lockfile entry that contradicted
its own specifier, which the next `pnpm install --frozen-lockfile`
rejected with `ERR_PNPM_OUTDATED_LOCKFILE`
[#&#8203;12764](https://redirect.github.com/pnpm/pnpm/issues/12764).

- `pnpm version -r --json` now outputs `[]` instead of human-readable
text when no pending changes exist
[`pnpm/pnpm#13217`](https://redirect.github.com/pnpm/pnpm/issues/13217).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v11.20.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.20.0):
pnpm 11.20

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.19.0...v11.20.0)

#### Minor Changes

- **Security fix.** Affects projects using `namedRegistries` on pnpm
11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you
use named registries" below.

The lockfile recorded no marker for which registry a package came from.
Packages were keyed by `name@version` alone, and entry lookup went
through `refToRelative(ref, name)`, so a dependency you declared against
one registry could be satisfied by an entry that was actually resolved
from another. When two registries served the same name and version, both
collapsed onto a single `packages:` entry and whichever resolved first
decided the tarball every consumer got.

That is a package-substitution risk: a package you expect from your
private registry could be installed from a different registry that
publishes the same name and version, and the lockfile recorded nothing
that would let you tell.

Packages resolved from a named registry are now recorded under
registry-qualified keys (`<name>@<registryName>:<version>`, e.g.
`foo@work:1.0.0`), so each registry gets its own entry and the lockfile
pins which one a dependency came from.

The lockfile format version is unchanged. Registry-qualified keys appear
only for packages resolved from a named registry, so a project that does
not use `namedRegistries` sees no difference, and older pnpm versions
keep reading the file.

##### If you use named registries

Your next non-frozen install re-keys those entries, which shows up as a
lockfile diff. Commit it — that diff is the fix being applied. Review
it: an entry that moves to a registry you did not expect is worth
investigating.

Everyone working on the project should be on this version or newer
before you do. An older pnpm reads the re-keyed lockfile fine — frozen
installs are unaffected — but it does not produce registry-qualified
keys itself, so any install that updates the lockfile writes those
entries back to the old shape, and the next install on a curren

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on the first day of the month"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-31 16:47:17 +00:00
renovate[bot] ba2433fd49 chore(deps): update dependency oxfmt to ^0.65.0 (#26065) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.64.0` →
`^0.65.0`](https://renovatebot.com/diffs/npm/oxfmt/0.64.0/0.65.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.65.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.65.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.64.0/0.65.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.64.0/0.65.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.65.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.64.0...oxfmt_v0.65.0)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.64.0...oxfmt_v0.65.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-24 14:05:56 +00:00
renovate[bot] 93bf42d3ec chore(deps): update dependency oxfmt to ^0.64.0 (#25877) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.61.0` →
`^0.64.0`](https://renovatebot.com/diffs/npm/oxfmt/0.61.0/0.64.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.64.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.64.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.61.0/0.64.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.61.0/0.64.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.64.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0640---2026-08-18)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.63.0...oxfmt_v0.64.0)

##### 🚀 Features

-
[`c07fe7c`](https://redirect.github.com/oxc-project/oxc/commit/c07fe7c)
oxfmt: Support `experimentalOperatorPosition`
([#&#8203;25643](https://redirect.github.com/oxc-project/oxc/issues/25643))
(leaysgur)

##### 📚 Documentation

-
[`fed6681`](https://redirect.github.com/oxc-project/oxc/commit/fed6681)
oxfmt: Skip expanding overrides options
([#&#8203;25572](https://redirect.github.com/oxc-project/oxc/issues/25572))
(leaysgur)

###
[`v0.63.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.62.0...oxfmt_v0.63.0)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.62.0...oxfmt_v0.63.0)

###
[`v0.62.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0620---2026-08-03)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.61.0...oxfmt_v0.62.0)

##### 🐛 Bug Fixes

-
[`e6e584b`](https://redirect.github.com/oxc-project/oxc/commit/e6e584b)
oxfmt: Type jsdoc. enum options
([#&#8203;25008](https://redirect.github.com/oxc-project/oxc/issues/25008))
(leaysgur)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zMi42IiwidXBkYXRlZEluVmVyIjoiNDQuMzIuNiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-18 15:50:26 +00:00
overlookmotel a4478e960a feat(codegen): add oxc-codegen package (#25488) 
Add `oxc-codegen` package - a printer written in TS.

### Features

- Prints JS, JSX, TS, TSX.
- Matches `oxc_codegen` exactly on all Test262, TypeScript, Acorn-JSX fixtures.
- Very fast.

### Deficiencies

- Pretty-printing only (no compact/minified output).
- No support for printing comments.
- Source map support is semi-there, but largely untested, and poor API (design doc has some ideas on how to improve it).

### This PR adds

- The printer code.
- Conformance testing infra.
- Further tests for edge cases.
- README.
- Design doc - how it differs from `oxc_codegen` and why, what produces the perf.

### This PR doesn't add

- Not integrated into CI or release pipeline.

### Notes

This started as a slop port of `oxc_codegen`. I've iterated on that base, cleaned it up a lot, and at least skimmed through all of it. I think it's in fairly decent shape.

The design doc is I think worth a read. It explains the rationale for the choices, in particular the "1 codebase, 4 builds" approach.

I've put it in a new top-level directory called `packages`. It's not an app, so didn't seem to me to fit alongside `apps/oxlint` and `apps/oxfmt`. It's pure JS, so not like e.g. `napi/parser`. And it felt too heavyweight to put into `npm` dir. But maybe there's a better place for it.

Co-authored-by: Cameron <cameron.clark@hey.com>
 2026-08-12 13:41:31 +00:00
renovate[bot] d9c288b064 chore(deps): update pnpm to v11.17.0 (#25161) 
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm))
| [`11.9.0` →
`11.17.0`](https://renovatebot.com/diffs/npm/pnpm/11.9.0/11.17.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.17.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/11.17.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/11.9.0/11.17.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.9.0/11.17.0?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v11.17.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.17.0):
pnpm 11.17

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.16.0...v11.17.0)

##### Minor Changes

- Added a new setting, `update.githubActionsServer`, for specifying the
base URL of the GitHub server that hosts the repositories of the GitHub
Actions referenced by the workflow files (for example, a GitHub
Enterprise Server). When the setting is not defined, the URL is read
from the `GITHUB_SERVER_URL` environment variable, falling back to
`https://github.com`. The URL must use the `https://` or `http://`
protocol
[#&#8203;13220](https://redirect.github.com/pnpm/pnpm/issues/13220).

`pnpm outdated` and `pnpm update` no longer fail when the refs of a
GitHub Action's repository cannot be read (for example, when the
action's repository is private or hosted on a different GitHub server).
Such actions are now skipped with a warning.

Setting `update.githubActions` to `false` now makes `pnpm outdated` and
the interactive `pnpm update` skip GitHub Actions dependencies.

##### Patch Changes

- The token poll for web-based authentication no longer reads the body
of non-OK or still-pending (HTTP 202) responses, and caps the token
response body it does read at 64 KiB, so a malicious or compromised
registry cannot exhaust memory through the poll
[pnpm/pnpm#12721](https://redirect.github.com/pnpm/pnpm/issues/12721).

- Fixed `catalog:` references in dependencies and overrides failing to
resolve when installing through a pnpr server, which errored with "No
catalog entry '<name>' was found for catalog 'default'." even though the
catalog entry existed. Also fixed a crash on Windows when installing a
nested workspace member (e.g. `packages/foo`) through a pnpr server
[#&#8203;13232](https://redirect.github.com/pnpm/pnpm/issues/13232).

- Republished every package: the tarballs published by the v11.13.1
through v11.16.0 releases were missing most of their compiled files due
to a packing bug
[#&#8203;13164](https://redirect.github.com/pnpm/pnpm/issues/13164).

- Revert script ordering change for `pnpm run --sequential /regex/`

- Support the `from-git` argument in the `pnpm version` command.

- When the authentication URL cannot be rendered as a QR code (for
example when it exceeds the maximum QR data capacity), web-based login
now displays the URL alone with a warning instead of aborting
authentication
[pnpm/pnpm#12721](https://redirect.github.com/pnpm/pnpm/issues/12721).

<!-- sponsors -->

##### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

##### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v11.16.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.16.0):
pnpm 11.16

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.15.1...v11.16.0)

#### Minor Changes

- The first release of a package now publishes the version written in
its manifest verbatim, instead of bumping off it. `pnpm version -r` and
`pnpm change status` check the registry for each release's current
version; when that version is not yet published, the package debuts at
it and its pending changesets apply only from the next release. A newly
added package seeded at `1100.0.0` with a `minor` changeset is therefore
published as `1100.0.0` rather than skipping straight to `1100.1.0`.

- Added a `--changeset` flag to `pnpm update`. Set `update.changeset` to
`true` in `pnpm-workspace.yaml` to enable this behavior by default, and
use `--no-changeset` to override the setting for one update. After the
update completes, pnpm writes a `.changeset/pnpm-update-<suffix>.md`
file declaring a patch bump for every workspace package whose
`dependencies` or `optionalDependencies` were changed by the update and
a major bump when `peerDependencies` changed, including packages that
consume an updated catalog entry via the `catalog:` protocol. Private
packages, packages without a name, and packages listed in the `ignore`
array of `.changeset/config.json` are skipped. If
`.changeset/config.json` does not exist, a warning is printed and no
changeset is generated.

- Added GitHub Actions dependencies to `pnpm outdated` and interactive
`pnpm update`. Non-interactive updates can include them with
`--include-github-actions` or by setting `update.githubActions` to
`true` in `pnpm-workspace.yaml`. Updated actions are pinned to exact
commit hashes with their release tags preserved in comments.

- Added `update` and `audit` settings sections to `pnpm-workspace.yaml`,
superseding the awkwardly named `updateConfig`, `auditConfig`, and
top-level `auditLevel` settings:

  ```yaml
  update:
    ignoreDeps: # was updateConfig.ignoreDependencies
      - webpack
      - "@&#8203;babel/*"

  audit:
    level: high # was auditLevel
    ignore: # was auditConfig.ignoreGhsas
      - GHSA-xxxx-yyyy-zzzz
  ```

`update.ignoreDeps` lists dependency name patterns that `pnpm update`
and `pnpm outdated` should skip. `audit.level` and `audit.ignore` tune
`pnpm audit`.

The deprecated `updateConfig`, `auditConfig`, and `auditLevel` settings
keep working until the next major version. When both a new section value
and its deprecated counterpart are set, the new section takes precedence
and a warning is printed. Both the TypeScript CLI and the Rust config
surface (pacquet) recognize the new sections.

#### Patch Changes

- Fixed `pnpm add --save-exact`/`--save-prefix` and `pnpm update`
writing a package's version with the `peerDependencies` range's prefix
(e.g. `^19.2.7` instead of the requested `19.2.7`) whenever the same
package also appeared in `peerDependencies`. A real
`dependencies`/`devDependencies`/`optionalDependencies` entry now takes
precedence over a same-named `peerDependencies` entry when computing the
current specifiers
[#&#8203;13108](https://redirect.github.com/pnpm/pnpm/issues/13108).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v11.15.1`](https://redirect.github.com/pnpm/pnpm/compare/v11.15.0...v11.15.1)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.15.0...v11.15.1)

###
[`v11.15.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.15.0):
pnpm 11.15

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.14.0...v11.15.0)

##### Minor Changes

- Optional peer dependencies declared only via `peerDependenciesMeta`
(for example `debug`'s `supports-color` peer) are now resolved from a
satisfying version already present in the dependency graph, the same way
explicitly declared optional peer dependencies are. Previously such
peers were only resolved this way when the package's metadata was read
back from the lockfile, so an unrelated dependency change could rewrite
peer resolutions across the whole lockfile.

##### Patch Changes

- Updated `adm-zip` to prevent crafted ZIP archives from causing
excessive memory allocation.

- `pnpm version -r` no longer writes a versioning-ledger entry with no
consumed intents as a bare `intents:` key, which the next run failed to
read with `ERR_PNPM_INVALID_VERSIONING_LEDGER`. Empty intent lists are
now written as `intents: []`, and the ledger reader accepts the bare
form left by earlier releases.

- Fixed pnpr workspace resolution to preserve project names and versions
for `workspace:` dependencies.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v11.14.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.14.0):
pnpm 11.14

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.13.1...v11.14.0)

#### Minor Changes

- `peerDependencies` now accept dependency specifiers that carry a
scheme — a named-registry spec (`<registry>:<version>`), an `npm:`
alias, or a `file:`/git/URL spec — instead of rejecting them with
`ERR_PNPM_INVALID_PEER_DEPENDENCY_SPECIFICATION`
[#&#8203;13095](https://redirect.github.com/pnpm/pnpm/issues/13095).
Such a peer is matched against the semver range carried by the specifier
(`work:5.x.x` is checked as `5.x.x`, `npm:bar@^5` as `^5`), or against
`*` when it carries no version, while the original specifier still
selects the package to auto-install. Bare `name@version` values, which
are almost always a mistake, are still rejected.

- Added `pnpm doctor`, which diagnoses the pnpm installation and the
environment it runs in: the versions and install method, whether the
global bin directory is on `PATH`, whether the store and cache are
writable, which link strategies (reflink, hardlink, symlink) the store's
filesystem supports, registry connectivity, and an offline `file:`
install that exercises the resolve/store/link path end to end. Each
check reports how to fix what it finds, and the command exits non-zero
when any check fails.

Use `--offline` to skip the checks that need network access, `--json`
for machine-readable output, and `--benchmark` to time the filesystem
and install checks.

- Added support for executing multiple scripts matching a RegExp passed
to `pnpm run` (e.g., `pnpm run "/^build:.*/"`), running matched scripts
in deterministic lexicographical order. Restored the `--sequential`
(`-s`) CLI option for `pnpm run`, which forces `workspaceConcurrency` to
1 so that matched scripts run sequentially one by one across and within
packages.

#### Patch Changes

- Fixed `pnpm install` failing with `ERR_PNPM_LOCKFILE_IS_SYMLINK` when
`pnpm-lock.yaml` is a symlink, as build sandboxes such as Bazel and Nix
stage it
[#&#8203;13073](https://redirect.github.com/pnpm/pnpm/issues/13073).
Reading a lockfile through a symlink is allowed again, and an install
that leaves the lockfile unchanged no longer rewrites it, so
`--frozen-lockfile` no longer needs to write at all. Writing a *changed*
lockfile through a symlink is still refused, as that would redirect the
write onto the symlink's target.

- Fixed frozen installs incorrectly treating equivalent Git dependency
specifiers as a stale lockfile. See
[#&#8203;13039](https://redirect.github.com/pnpm/pnpm/issues/13039).

- `pnpm owner ls` now reports authentication and authorization failures
(401/403) as dedicated errors that include the registry's response body,
matching `pnpm owner add`/`rm`, instead of a generic `Failed to fetch
owners` message.

- Recover from a metadata cache entry that disappears (concurrent cache
cleanup, antivirus) after the registry has already answered the
conditional request with `304 Not Modified`. The metadata is
re-requested once without cache validators instead of failing the
install with `ERR_PNPM_CACHE_MISSING_AFTER_304`.

- A project pinned to a broken pnpm release via `packageManager` or
`devEngines.packageManager` now reports which release is broken and what
to do about it, instead of failing inside the installer. `pnpm
self-update` already refused these releases; the version switch does
too.

- Prevent broken-lockfile errors from including snippets of the
lockfile's contents.

- `pnpm self-update` now checks that the version it installed can run
before making it the active pnpm. A release that installs but cannot
execute is discarded with an error instead of replacing a working
installation.

- Fixed an out-of-memory regression when workspace projects concurrently
resolve a package with large registry metadata
[pnpm/pnpm#13077](https://redirect.github.com/pnpm/pnpm/issues/13077).

- Fixed `pnpm update` rewriting exact version pins that use the `=`
operator (for example `=3.5.1`) to a caret range (`^3.5.1`). Exact pins
are now preserved and written back as the bare version. See
[#&#8203;12745](https://redirect.github.com/pnpm/pnpm/issues/12745).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v11.13.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.13.1):
pnpm 11.13.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.13.0...v11.13.1)

#### Patch Changes

- Fixed `pnpm pack` applying workspace-root ignore rules when a
workspace package has its own `.npmignore` file.
- Keep the interactive `minimumReleaseAge` approval prompt visible
during `pnpm install`. The progress reporter now pauses its redraws
while a prompt is waiting for input instead of overwriting it, so the
install no longer hangs on a question the user cannot see
[#&#8203;13019](https://redirect.github.com/pnpm/pnpm/issues/13019).
- Fixed `pnpm self-update` failing to link native platform binaries
stored in sibling global virtual store slots.

###
[`v11.13.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.13.0):
pnpm 11.13

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.12.0...v11.13.0)

#### Minor Changes

- Added `versioning.epics` to `pnpm-workspace.yaml`. An epic ties a
group of member packages to a lead package, constraining every member's
major version to a band derived from the lead's major: while the lead is
on major `M`, members live in `M*100 … M*100+99`. Members move
independently inside the band (patch, minor, and a `major` intent that
stays in-band); a bump that would carry a member past the band ceiling
is rejected until the lead advances its own major. When a release plan
takes the lead to a new stable major, every member re-bases to the band
floor in the same plan. Membership is matched with pnpm's package
selectors — name globs, `./`-prefixed directory globs, and `!`-prefixed
negations.

- Added the `team` command for managing organization teams and team
memberships on the registry, with create, destroy, add, rm, and ls
subcommands and support for --otp, --parseable, and --json flags.

- Added native workspace release management
[#&#8203;12952](https://redirect.github.com/pnpm/pnpm/issues/12952): the
new `pnpm change` command records change intents as
changesets-compatible `.changeset/*.md` files (`pnpm change status`
shows the pending release plan), and the bare `pnpm version -r` consumes
them — bumping versions across the workspace with dependent propagation
through `workspace:` ranges, fixed groups, a `maxBump` cap, `--filter`
narrowing, and `--dry-run` — writing changelogs, and recording consumed
intents in a committed ledger that keeps cherry-picks and merge-backs
between release branches safe. Packages can be moved onto per-package
release lanes with the new `pnpm lane <name> --filter <pkg>` command and
back with `pnpm lane main --filter <pkg>` (`pnpm lane` shows the
membership), releasing `X.Y.Z-lane.N` prereleases from the same runs
that release stable versions of the packages on the main lane.
Configuration lives under the new `versioning` key of
`pnpm-workspace.yaml` (`fixed`, `ignore`, `maxBump`, `lanes`,
`changelog`). When two workspace projects publish the same name, intent
files, `versioning.lanes`, and `versioning.fixed`/`ignore` may reference
a project by its workspace-relative directory path (e.g.
`"./pnpm/npm/pnpm"`) — the one additive extension to the changesets
format, applied automatically by `pnpm change`.

Release changelogs default to `registry` storage
(`versioning.changelog.storage`): no `CHANGELOG.md` is committed. Each
release's section is composed at publish time and packed into the
published tarball on top of the previously published version's
changelog, and the consumed change intents are garbage-collected by a
later `pnpm version -r` only once the registry confirms the version is
published with its section. Set `versioning.changelog.storage:
repository` to keep committed `CHANGELOG.md` files instead.

- Added a new override selector form with an empty range — `"pkg@":
"<version>"` — called a convergence override. It rewrites a dependency
edge only when its exact version satisfies the edge's declared range, so
compatible consumers converge on one version while incompatible
consumers keep their own resolution — now and for any dependent added in
the future
[#&#8203;12794](https://redirect.github.com/pnpm/pnpm/issues/12794).

  ```yaml
  overrides:
    "form-data@": 4.0.6
  ```

The value must be an exact version. When a full resolution detects that
every declared range also admits a newer version, pnpm warns that the
override is stale and names the version to converge on. Previously an
empty range in an override selector was undocumented and behaved like a
bare (unscoped) override.

#### Patch Changes

- A `tokenHelper` set in the global pnpm `auth.ini` is no longer
rejected as project-level configuration. The guard that blocks
`tokenHelper` from a project `.npmrc` only treated `~/.npmrc` as a
trusted source, so a helper written to `auth.ini` (for example by `pnpm
config set`) failed on every command and could not even be removed with
`pnpm config delete`. A `tokenHelper` in a workspace or project `.npmrc`
is still rejected.

- `pnpm cache delete` now removes a package's metadata from every
metadata cache directory (`metadata`, `metadata-full`, and
`metadata-full-filtered`), instead of only the one the current
resolution mode reads. Previously a package cached under a different
mode (e.g. `metadata-full-filtered`) was left behind. Closes
[#&#8203;12753](https://redirect.github.com/pnpm/pnpm/issues/12753).

- Fixed an injected workspace dependency (`injectWorkspacePackages:
true`) incorrectly staying as `file:` instead of deduping back to
`link:` when an unrelated, ordinary shared dependency resolved to a
peer-suffixed variant for the target project's own copy but not for the
injected occurrence. See
[#&#8203;10433](https://redirect.github.com/pnpm/pnpm/issues/10433).

- `pnpm deploy` now supports workspaces that use catalogs.

- Fixed `pnpm deploy` with a shared lockfile so local `file:` tarball
dependencies keep their package name in the generated deploy lockfile.
This prevents warm-store deploys from failing with
`ERR_PNPM_UNEXPECTED_PKG_CONTENT_IN_STORE` when the tarball filename
includes the version.

- Options that follow `create`, `exec`, or `test` appearing as a
subcommand of another command are now parsed instead of being silently
treated as positional parameters. For example, `pnpm team create
@&#8203;org:team --registry <url>` previously ignored the `--registry`
option and sent the request to the default registry.

- `pnpm add -g`, `pnpm update -g`, `pnpm setup`, and the self-updater no
longer fail with `ERR_PNPM_MISSING_TIME` when `trustPolicy:
no-downgrade` or `resolutionMode: time-based` is set in the global
config
[#&#8203;12883](https://redirect.github.com/pnpm/pnpm/issues/12883). The
decision to fetch full registry metadata now lives in one place, and the
`no-downgrade` trust policy always requests full metadata (matching the
self-updater), since the trust evidence it checks is missing from
abbreviated metadata even on registries that include the `time` field.

- `pnpm list` and `pnpm why` no longer crash with `EMFILE: too many open
files` when a project has a large number of unsaved dependencies
(packages present in `node_modules` but not in the lockfile). The reads
of those packages are now concurrency-limited.

- The published `pnpm` package no longer declares `dependencies` or
`devDependencies`. Because the CLI bundles its runtime dependencies into
`dist/node_modules`, those fields are dropped when packing, so `npm
install` of the tarball no longer tries to resolve internal-only
packages such as `@pnpm/test-ipc-server`. Closes
[#&#8203;12955](https://redirect.github.com/pnpm/pnpm/issues/12955).

- Fixed `pnpm publish --otp` and `pnpm publish --batch --otp` to send
the configured OTP to the registry.

- `pnpm publish` again sends the package's README to the registry as
metadata, so registries can render it on the package page. The readme is
always included in the published metadata (matching the npm CLI), while
the `embed-readme` setting continues to control only whether the readme
is written into the `package.json` inside the tarball. This restores the
behavior that was lost when publishing became fully native. Closes
[#&#8203;12966](https://redirect.github.com/pnpm/pnpm/issues/12966).

- Fixed the dependency status check wrongly reporting "up to date" when
a `package.json`, `.pnpmfile.cjs`, or patch file was edited in the same
second as the previous install, on filesystems that record mtimes at
whole-second resolution (for example ext4 with 128-byte inodes). The
optimistic repeat-install fast path and `verify-deps-before-run`
compared mtimes strictly, so a same-second edit whose mtime rounded down
looked unchanged and re-resolution was skipped. Such a file's whole
second is now treated as possibly-modified, falling through to the
content check; behavior on sub-second filesystems is unchanged.

- Retry package metadata requests when a registry or proxy returns `304
Not Modified` to an unconditional request, preventing false
`ERR_PNPM_CACHE_MISSING_AFTER_304` failures
[pnpm/pnpm#12882](https://redirect.github.com/pnpm/pnpm/issues/12882).

If the retry also returns `304`, report
`ERR_PNPM_META_NOT_MODIFIED_WITHOUT_CACHE` instead.

- Fixed `pnpm update` removing transitive lockfile entries when
`dedupePeerDependents` is disabled and the selected package is absent
[pnpm/pnpm#12456](https://redirect.github.com/pnpm/pnpm/issues/12456).

- Limit modern deploy lockfiles and localized virtual stores to
dependencies reachable from the selected dependency groups.

- A `tokenHelper` command is now given a 60-second time limit. A helper
that hangs (deadlock, stuck I/O) is killed and reported as an error
instead of leaving the command waiting forever.

- Fixed orphaned child processes on Windows when pnpm exits on an error
while commands spawned by `pnpm exec` or `pnpm dlx` are still running
(for example, when one project's command fails during `pnpm --recursive
exec`). The PIDs of these commands are now recorded when they are
spawned and their whole process trees are terminated with `taskkill` on
an error exit. Previously the cleanup relied on enumerating the system
process list, which is so slow on Windows that the enumeration hit its
timeout and the cleanup was silently skipped
[#&#8203;12406](https://redirect.github.com/pnpm/pnpm/issues/12406).

- `pnpm pack` now respects workspace-root `.npmignore` and `.gitignore`
files when packing workspace packages.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v11.12.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.12.0):
pnpm 11.12

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.11.0...v11.12.0)

#### Minor Changes

- [`a897ef7`](https://redirect.github.com/pnpm/pnpm/commit/a897ef7):
Custom fetchers exported from a pnpmfile can now delegate by returning a
`{ delegate: <resolution> }` envelope: pnpm rewrites the package's
resolution to the delegated shape and runs the built-in fetcher on it.
This is the portable delegation form that also works in pacquet, where
`cafs` and `fetchers` cannot be passed to the hook. Related to
[pnpm/pnpm#11685](https://redirect.github.com/pnpm/pnpm/issues/11685).

#### Patch Changes

- [`2b02764`](https://redirect.github.com/pnpm/pnpm/commit/2b02764): The
changed-packages filter (`--filter "...[<since>]"`) no longer allows an
option-like `<since>` value (such as `--output=<path>`) to be
interpreted as a git option — git now rejects it as a bad revision. The
repository root is also resolved to the nearest `.git` entry, so the
filter works in a git worktree checked out inside another repository's
tree.

- [`43711ce`](https://redirect.github.com/pnpm/pnpm/commit/43711ce):
`pnpm outdated` no longer checks the registry for dependencies that are
resolved from local `link:`, `file:`, or `workspace:` references in the
lockfile
[#&#8203;12827](https://redirect.github.com/pnpm/pnpm/issues/12827).

- [`3c6718b`](https://redirect.github.com/pnpm/pnpm/commit/3c6718b):
Fixed a deadlock in peer dependency resolution: `pnpm install` hung
forever when a peer dependency cycle spanned a project's own
dependencies and auto-installed peer providers, for example when
installing `electron-builder@26.15.3`
[#&#8203;12921](https://redirect.github.com/pnpm/pnpm/issues/12921).

- [`252f15e`](https://redirect.github.com/pnpm/pnpm/commit/252f15e):
Fixed peer dependency auto-install picking a version the peer range
rejects. In a workspace with several projects, a package declaring a
peer dependency with a semver range (for example `^1.0.0`) could get the
highest version found anywhere in the workspace (for example a `2.0.0`
resolved for another project) instead of a version that satisfies the
range. Peers are now deduplicated onto the highest preferred version
that satisfies the declared range, and when none does, the range is
resolved from the registry.

Also fixed re-resolving with an existing lockfile hoisting a different
peer version than a fresh install of the same manifest: root
dependencies reused from the lockfile were invisible to peer hoisting,
so a peer that a root dependency provides could be bound to another
version.

- [`a38adda`](https://redirect.github.com/pnpm/pnpm/commit/a38adda):
`pnpm self-update <version>` now installs the requested pnpm version
when it matches the currently running version but is missing from the
global self-update directory.

- [`6a85968`](https://redirect.github.com/pnpm/pnpm/commit/6a85968):
`pnpm stage list` now stops paginating after a fail-safe cap of 1000
pages, so a misbehaving registry cannot keep the command looping
forever.

- [`eee7c9a`](https://redirect.github.com/pnpm/pnpm/commit/eee7c9a):
`verify-deps-before-run` no longer spawns a `pnpm install` when pnpm is
executed in a directory that has no `package.json`. A mistyped command
run outside a project (for example `pnpm witch 10 login`) used to crash
with a confusing error from the spawned install; now it fails with the
regular "no package.json found" error.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v11.11.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm11/pnpm/CHANGELOG.md#11110)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.10.0...v11.11.0)

##### Minor Changes

- [`508b8c2`](https://redirect.github.com/pnpm/pnpm/commit/508b

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on the first day of the month"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-31 19:07:43 +00:00
renovate[bot] 5e9132308e chore(deps): update dependency oxfmt to ^0.61.0 (#24993) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.60.0` →
`^0.61.0`](https://renovatebot.com/diffs/npm/oxfmt/0.60.0/0.61.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.61.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.61.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.60.0/0.61.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.60.0/0.61.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.61.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.60.0...oxfmt_v0.61.0)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.60.0...oxfmt_v0.61.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-27 17:28:09 +01:00
renovate[bot] 3f24ee2ea8 chore(deps): update dependency oxfmt to ^0.60.0 (#24782) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.59.0` →
`^0.60.0`](https://renovatebot.com/diffs/npm/oxfmt/0.59.0/0.60.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.60.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.60.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.59.0/0.60.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.59.0/0.60.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.60.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.59.0...oxfmt_v0.60.0)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.59.0...oxfmt_v0.60.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzIuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-22 01:57:59 +00:00
camc314 6ce51d3ff3 chore(deps): update dependency oxlint-tsgolint to v7.0.2000 (#24763) 2026-07-21 14:55:25 +00:00
renovate[bot] f8f28ce781 chore(deps): update dependency oxlint-tsgolint to v0.25.0 (#24610) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) |
[`0.24.0` →
`0.25.0`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.24.0/0.25.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.25.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.25.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.24.0/0.25.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.24.0/0.25.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

###
[`v0.25.0`](https://redirect.github.com/oxc-project/tsgolint/releases/tag/v0.25.0)

[Compare
Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.24.0...v0.25.0)

#### What's Changed

- chore(deps): update pnpm to v11.9.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;1043](https://redirect.github.com/oxc-project/tsgolint/pull/1043)
- perf(no-unnecessary-type-parameters): reuse AST-walk visitor closure
by [@&#8203;connorshea](https://redirect.github.com/connorshea) in
[#&#8203;1034](https://redirect.github.com/oxc-project/tsgolint/pull/1034)
- perf(strict-void-return): reuse function-body walk visitor closure by
[@&#8203;connorshea](https://redirect.github.com/connorshea) in
[#&#8203;1033](https://redirect.github.com/oxc-project/tsgolint/pull/1033)
- chore: update typescript-go submodule by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;1048](https://redirect.github.com/oxc-project/tsgolint/pull/1048)
- docs: normalize README sponsor section by
[@&#8203;Boshen](https://redirect.github.com/Boshen) in
[#&#8203;1050](https://redirect.github.com/oxc-project/tsgolint/pull/1050)
- chore: strip symbols from release binary by
[@&#8203;Boshen](https://redirect.github.com/Boshen) in
[#&#8203;1049](https://redirect.github.com/oxc-project/tsgolint/pull/1049)
- chore: add -trimpath to release build by
[@&#8203;Boshen](https://redirect.github.com/Boshen) in
[#&#8203;1051](https://redirect.github.com/oxc-project/tsgolint/pull/1051)
- chore(deps): update crate-ci/typos action to v1.48.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;1052](https://redirect.github.com/oxc-project/tsgolint/pull/1052)
- chore(deps): update github actions by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;1056](https://redirect.github.com/oxc-project/tsgolint/pull/1056)
- chore(deps): update npm packages by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;1057](https://redirect.github.com/oxc-project/tsgolint/pull/1057)
- fix(no-deprecated): avoid contextual union property false positives by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;1059](https://redirect.github.com/oxc-project/tsgolint/pull/1059)
- fix(prefer-optional-chain): preserve negated optional guard by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;1061](https://redirect.github.com/oxc-project/tsgolint/pull/1061)
- perf(linter): gate reportNodeWithSuggestions on FixSuggestions by
[@&#8203;connorshea](https://redirect.github.com/connorshea) in
[#&#8203;1067](https://redirect.github.com/oxc-project/tsgolint/pull/1067)
- fix(switch-exhaustiveness-check): honor default case comment patterns
by [@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;1070](https://redirect.github.com/oxc-project/tsgolint/pull/1070)
- perf(strict-void-return): skip type queries for never-callable
expressions by
[@&#8203;connorshea](https://redirect.github.com/connorshea) in
[#&#8203;1068](https://redirect.github.com/oxc-project/tsgolint/pull/1068)
- perf(no-unsafe-argument): skip type queries for never-unsafe arguments
by [@&#8203;connorshea](https://redirect.github.com/connorshea) in
[#&#8203;1066](https://redirect.github.com/oxc-project/tsgolint/pull/1066)
- Revert "perf(strict-void-return): skip type queries for never-callable
expressions" by [@&#8203;camc314](https://redirect.github.com/camc314)
in
[#&#8203;1071](https://redirect.github.com/oxc-project/tsgolint/pull/1071)
- chore: update typescript-go submodule by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;1072](https://redirect.github.com/oxc-project/tsgolint/pull/1072)
- chore(deps): update dependency dprint-json to v0.23.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;1080](https://redirect.github.com/oxc-project/tsgolint/pull/1080)
- chore(deps): update taiki-e/install-action action to v2.83.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;1082](https://redirect.github.com/oxc-project/tsgolint/pull/1082)
- chore(deps): update gomod by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;1081](https://redirect.github.com/oxc-project/tsgolint/pull/1081)
- perf(no-unnecessary-type-arguments): skip signature resolution when
node has no type arguments by
[@&#8203;connorshea](https://redirect.github.com/connorshea) in
[#&#8203;1064](https://redirect.github.com/oxc-project/tsgolint/pull/1064)
- refactor: miscellaneous code cleanup by
[@&#8203;connorshea](https://redirect.github.com/connorshea) in
[#&#8203;1077](https://redirect.github.com/oxc-project/tsgolint/pull/1077)
- refactor: remove dead code from rules by
[@&#8203;connorshea](https://redirect.github.com/connorshea) in
[#&#8203;1079](https://redirect.github.com/oxc-project/tsgolint/pull/1079)
- refactor: drop dead isFunction guards built on a bitwise ast.Kind mask
by [@&#8203;connorshea](https://redirect.github.com/connorshea) in
[#&#8203;1078](https://redirect.github.com/oxc-project/tsgolint/pull/1078)
- chore: update Node.js to 26.5.0 by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;1087](https://redirect.github.com/oxc-project/tsgolint/pull/1087)
- fix(no-unnecessary-type-assertion): avoid recursive unknown checks by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;1086](https://redirect.github.com/oxc-project/tsgolint/pull/1086)
- fix(no-unnecessary-type-assertions): generic array false positive by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;1045](https://redirect.github.com/oxc-project/tsgolint/pull/1045)
- fix(no-unnecessary-type-assertion): preserve generic write casts by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;1089](https://redirect.github.com/oxc-project/tsgolint/pull/1089)
- docs: update sponsor section by
[@&#8203;Boshen](https://redirect.github.com/Boshen) in
[#&#8203;1090](https://redirect.github.com/oxc-project/tsgolint/pull/1090)

**Full Changelog**:
<https://github.com/oxc-project/tsgolint/compare/v0.24.0...v0.25.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-17 10:08:45 +01:00
renovate[bot] 7b91622d95 chore(deps): update dependency oxfmt to ^0.59.0 (#24496) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.58.0` →
`^0.59.0`](https://renovatebot.com/diffs/npm/oxfmt/0.58.0/0.59.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.59.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.59.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.58.0/0.59.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.58.0/0.59.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.59.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0590---2026-07-13)

##### 🐛 Bug Fixes

-
[`415fe1e`](https://redirect.github.com/oxc-project/oxc/commit/415fe1e)
oxfmt: Error on ignorePatterns that cannot match files outside the
config directory
([#&#8203;24286](https://redirect.github.com/oxc-project/oxc/issues/24286))
(leaysgur)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-07-14 09:39:56 +01:00
renovate[bot] 81511b4568 chore(deps): update dependency oxfmt to ^0.58.0 (#24240) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.57.0` →
`^0.58.0`](https://renovatebot.com/diffs/npm/oxfmt/0.57.0/0.58.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.58.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.58.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.57.0/0.58.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.57.0/0.58.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.58.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.57.0...oxfmt_v0.58.0)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.57.0...oxfmt_v0.58.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Cameron <cameron.clark@hey.com>
 2026-07-07 10:23:12 +01:00
renovate[bot] a7a4dfa863 chore(deps): update pnpm to v11.9.0 (#23985) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) |
[`11.4.0` →
`11.9.0`](https://renovatebot.com/diffs/npm/pnpm/11.4.0/11.9.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.9.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/11.9.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/11.4.0/11.9.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.4.0/11.9.0?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the warning logs for
more information.

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v11.9.0`](https://redirect.github.com/pnpm/pnpm/compare/v11.8.0...v11.9.0)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.8.0...v11.9.0)

###
[`v11.8.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1180)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.7.0...v11.8.0)

##### Minor Changes

- [`c112b61`](https://redirect.github.com/pnpm/pnpm/commit/c112b61):
Added a `--dry-run` option to `pnpm install`. It runs a full dependency
resolution and reports what an install would change, but writes nothing
to disk (no lockfile, no `node_modules`) and always exits with code 0.
This mirrors the preview semantics of `npm install --dry-run`
[#&#8203;7340](https://redirect.github.com/pnpm/pnpm/issues/7340).
- [`179ebc4`](https://redirect.github.com/pnpm/pnpm/commit/179ebc4):
`pnpm run --no-bail` now exits with a non-zero exit code when any of the
executed scripts fail, while still running every matched script to
completion. This makes the exit-code behavior of `--no-bail` consistent
between recursive and non-recursive runs (recursive runs already failed
at the end). Previously, a non-recursive `pnpm run --no-bail` always
exited with code 0, even when a script failed
[#&#8203;8013](https://redirect.github.com/pnpm/pnpm/issues/8013).
- [`0474a9c`](https://redirect.github.com/pnpm/pnpm/commit/0474a9c):
Added support for generating Node.js package maps at
`node_modules/.package-map.json` during isolated and hoisted installs.
Added the `node-experimental-package-map` setting to inject the
generated map into pnpm-managed Node.js script environments, and the
`node-package-map-type` setting to choose between `standard` and `loose`
package maps.
- [`dcededc`](https://redirect.github.com/pnpm/pnpm/commit/dcededc):
`pnpm sbom` now marks components reachable only through
`devDependencies` with CycloneDX `scope: "excluded"` and the
`cdx:npm:package:development` property. The `excluded` scope documents
"component usage for test and other non-runtime purposes", which matches
the semantics of a devDependency; the property is the CycloneDX
npm-taxonomy marker emitted by `@cyclonedx/cyclonedx-npm`, so both
modern (scope) and existing (property) consumers are covered. Components
reachable at runtime (including installed `optionalDependencies`) omit
`scope` and default to `required`.
- [`1495cb0`](https://redirect.github.com/pnpm/pnpm/commit/1495cb0):
Added per-package SBOM generation with `--out` and `--split` flags. Use
`--out out/%s.cdx.json` to write one SBOM per workspace package to
individual files, or `--split` for NDJSON output to stdout. When
`--filter` selects a single package, the SBOM root component now uses
that package's metadata. Workspace inter-dependencies (`workspace:`
protocol) and their transitive dependencies are included. Author,
repository, and license fall back to the root manifest when the package
doesn't define them.
- [`293921a`](https://redirect.github.com/pnpm/pnpm/commit/293921a):
feat(view): support searching project manifest upward when package name
is omitted

When running `pnpm view` without a package name, the command now
searches
upward for the nearest project manifest (`package.json`, `package.yaml`,
or `package.json5`) and uses its `name` field.
  If the manifest exists but lacks a `name` field, an error is thrown.

  This change also replaces the `find-up` dependency with `empathic` for
  improved performance and consistency across workspace tools.

##### Patch Changes

- [`29ab905`](https://redirect.github.com/pnpm/pnpm/commit/29ab905):
Fixed `pnpm update` overriding the version range policy of a named
catalog whose name parses as a version (e.g. `catalog:express4-21`). The
`catalog:` reference carries no pinning of its own, so the prefix from
the catalog entry (such as `~`) is now preserved instead of being
widened to `^`
[#&#8203;10321](https://redirect.github.com/pnpm/pnpm/issues/10321).

- [`bee4bf4`](https://redirect.github.com/pnpm/pnpm/commit/bee4bf4):
Security: validate config dependency names and versions from the env
lockfile (`pnpm-lock.yaml`) before using them to build filesystem paths.
A committed lockfile with a traversal-shaped `configDependencies` name
(such as `../../PWNED`) or version (such as `../../../PWNED`) could
previously cause `pnpm install` to create symlinks or write package
files outside `node_modules/.pnpm-config` and the store. Names must now
be valid npm package names and versions must be exact semver versions;
the same validation is applied to optional subdependencies of config
dependencies, and to the legacy workspace-manifest format before any
lockfile is written. See
[GHSA-qrv3-253h-g69c](https://redirect.github.com/pnpm/pnpm/security/advisories/GHSA-qrv3-253h-g69c).

- [`96bdd57`](https://redirect.github.com/pnpm/pnpm/commit/96bdd57): Fix
`link:` workspace protocol switching to `file:` after `pnpm rm` is run
from inside a workspace package whose target workspace dependency has
its own dependencies, when `injectWorkspacePackages: true` is set.
Follow-up to
[#&#8203;10575](https://redirect.github.com/pnpm/pnpm/pull/10575), which
fixed the same symptom for workspace packages without dependencies.

- [`302a2f7`](https://redirect.github.com/pnpm/pnpm/commit/302a2f7): No
longer warn about using both `packageManager` and
`devEngines.packageManager` when the two fields pin the same package
manager at the same version with the same integrity hash (e.g. both
`pnpm@11.5.1+sha512.…`). Previously the hash was stripped from the
legacy `packageManager` field but not from `devEngines.packageManager`,
so even identical specifications looked like a mismatch
[#&#8203;12028](https://redirect.github.com/pnpm/pnpm/issues/12028).

The warning still fires on any genuine divergence, and several cases now
state the specific reason instead of a single generic message: a
different package manager, a different version, or contradictory
integrity hashes for the same version.

- [`3f0fb21`](https://redirect.github.com/pnpm/pnpm/commit/3f0fb21):
Fixed the progress line showing leftover characters from external
processes that write to the terminal between progress updates (e.g. an
SSH passphrase prompt would leave a fragment like `added 0sa':`). The
interactive reporter now redraws each frame in place, erasing to the end
of the display before reprinting, so any such remnants are cleared
[#&#8203;12350](https://redirect.github.com/pnpm/pnpm/issues/12350).

- [`564619f`](https://redirect.github.com/pnpm/pnpm/commit/564619f):
Fixed `pnpm approve-builds` reporting "no packages awaiting approval"
when a build-script dependency whose approval was revoked (e.g. after
`git stash` drops the `allowBuilds` from `pnpm-workspace.yaml`) is
re-added. The revoked packages are now correctly recorded in
`.modules.yaml` so `approve-builds` can find them.
[#&#8203;12221](https://redirect.github.com/pnpm/pnpm/issues/12221)

- [`3d1fd20`](https://redirect.github.com/pnpm/pnpm/commit/3d1fd20):
Skip the redundant "target bin directory already contains an exe called
node" warning on Windows when the existing `node.exe` already matches
the target (same hard link or identical content)
[pnpm/pnpm#12203](https://redirect.github.com/pnpm/pnpm/issues/12203).

- [`1b02b47`](https://redirect.github.com/pnpm/pnpm/commit/1b02b47): Fix
macOS Gatekeeper blocking native binaries (`.node`, `.dylib`, `.so`) by
removing the `com.apple.quarantine` extended attribute after importing
them from the store.

When pnpm imports files from its content-addressable store into
`node_modules`, macOS preserves extended attributes, including
`com.apple.quarantine`. If this xattr is present on a store blob (e.g.
it was first written under a Gatekeeper-enabled app such as a Git
client), it propagates to `node_modules`, and Gatekeeper blocks the
native binary from loading even though pnpm already verified the file's
integrity against the lockfile.

After importing a package, pnpm now strips `com.apple.quarantine` from
its native binaries, matching Homebrew's behaviour of dropping
quarantine from verified downloads. The cleanup is macOS-only, runs in a
single batched `xattr` call per package, is restricted to native
binaries (other files are untouched), and is non-fatal (it logs a
warning on unexpected errors).

Fixes
[#&#8203;11056](https://redirect.github.com/pnpm/pnpm/issues/11056)

- [`61969fb`](https://redirect.github.com/pnpm/pnpm/commit/61969fb): Fix
`pnpm install` with `optimisticRepeatInstall` incorrectly reporting
`Already up to date` when `pnpm-lock.yaml` changed but project manifests
did not. This affected workflows such as checking out or restoring only
the lockfile
[#&#8203;12100](https://redirect.github.com/pnpm/pnpm/issues/12100).

Also fixes `checkDepsStatus` to use the correct lockfile path when
`useGitBranchLockfile` is enabled, so the optimistic fast-path and
lockfile modification detection work with `pnpm-lock.<branch>.yaml`
files instead of always stat'ing `pnpm-lock.yaml`. Merge-conflict
detection now reads the resolved lockfile name as well, and with
`mergeGitBranchLockfiles` enabled every `pnpm-lock.*.yaml` is scanned
for modifications and conflicts. The git branch is now resolved by
reading `.git/HEAD` directly (no process spawn) and uses the workspace
directory rather than `process.cwd()`.

- [`5c12968`](https://redirect.github.com/pnpm/pnpm/commit/5c12968): Fix
recursive updates of transitive dependencies when the update command
mixes transitive dependency patterns with direct dependency selectors.
For example, `pnpm up -r "@&#8203;babel/core" uuid` now updates matching
transitive `@babel/core` dependencies even when `uuid` is a direct
dependency selector
[#&#8203;12103](https://redirect.github.com/pnpm/pnpm/issues/12103).

- [`9d79ba1`](https://redirect.github.com/pnpm/pnpm/commit/9d79ba1):
Register the `pnpm update --no-save` flag in the CLI help and option
parser.

- [`0474a9c`](https://redirect.github.com/pnpm/pnpm/commit/0474a9c):
Fixed `pnpm import` for Yarn v2 lockfiles when `js-yaml` v4 is
installed.

- [`9e0c375`](https://redirect.github.com/pnpm/pnpm/commit/9e0c375):
Fixed `pnpm install` repeatedly prompting to remove and reinstall
`node_modules` in a workspace package when `enableGlobalVirtualStore` is
enabled. The post-install build step recorded a per-project
`node_modules/.pnpm` virtual store directory in
`node_modules/.modules.yaml`, overwriting the global `<storeDir>/links`
value the install step had written. The next install then detected a
virtual-store mismatch (`ERR_PNPM_UNEXPECTED_VIRTUAL_STORE`). The build
step now derives the same global virtual store directory as the install
step
[#&#8203;12307](https://redirect.github.com/pnpm/pnpm/issues/12307).

- [`223d060`](https://redirect.github.com/pnpm/pnpm/commit/223d060):
Document the `--cpu`, `--os` and `--libc` flags in the output of `pnpm
install --help`. These flags were already supported but were only
documented on the website
[#&#8203;12359](https://redirect.github.com/pnpm/pnpm/issues/12359).

- [`e85aea2`](https://redirect.github.com/pnpm/pnpm/commit/e85aea2):
Avoid reading `README.md` from disk when publishing if the publish
manifest already provides a `readme` field. The README is now only read
lazily, inside `createExportableManifest`, when it is actually needed.

- [`3188ae7`](https://redirect.github.com/pnpm/pnpm/commit/3188ae7):
Fixed `pnpm peers check` to accept loose peer dependency ranges such as
`>=3.16.0 || >=4.0.0-` when the installed peer version satisfies the
range
[#&#8203;12149](https://redirect.github.com/pnpm/pnpm/issues/12149).

- [`531f2a3`](https://redirect.github.com/pnpm/pnpm/commit/531f2a3):
Fixed `pnpm update` rewriting a `workspace:` dependency that points at a
local path (e.g. `workspace:../packages/foo/dist`) into a normalized
`link:` or version-range specifier. Such specifiers are now preserved
verbatim when the workspace protocol is preserved
[#&#8203;3902](https://redirect.github.com/pnpm/pnpm/issues/3902).

- [`fe66535`](https://redirect.github.com/pnpm/pnpm/commit/fe66535):
Fixed a lockfile non-convergence bug where an incremental install kept a
duplicate transitive dependency that a fresh install would not produce.
When a package is reused from the lockfile, its child edges are taken
verbatim and bypass the preferred-versions walk, so a transitive
dependency could stay pinned to an older version even after a direct
dependency resolved to a higher version that satisfies the same range.
The resolver now refreshes such a stale pin to the higher
direct-dependency version during resolution — so the older version is
never resolved or fetched, and the incremental result converges to the
fresh one.

- [`6d35338`](https://redirect.github.com/pnpm/pnpm/commit/6d35338):
`pnpm install` detects changes inside local file dependencies again. The
optimistic repeat-install fast path only tracks manifest and lockfile
modification times, so edits inside a local dependency's directory (or a
repacked local tarball) were reported as "Already up to date". Projects
with local file dependencies (`file:` and bare local path or tarball
specifiers, declared directly or through `pnpm.overrides`) now always
run a full install, which refetches those dependencies, matching pnpm
v10 behavior
[#&#8203;11795](https://redirect.github.com/pnpm/pnpm/issues/11795).

- [`4ca9247`](https://redirect.github.com/pnpm/pnpm/commit/4ca9247):
Preserve the existing Node.js runtime version prefix when resolving
`node@runtime:<range>` to a concrete version.

- [`30c7590`](https://redirect.github.com/pnpm/pnpm/commit/30c7590):
Create shorter CAFS temporary package directories to leave room for
lifecycle scripts that create IPC socket paths under TMPDIR.

- [`13815ad`](https://redirect.github.com/pnpm/pnpm/commit/13815ad):
Reporter output (warnings, progress) for `pnpm store` and `pnpm config`
subcommands now goes to stderr instead of stdout. This fixes scripts
that capture their stdout (e.g. `PNPM_STORE=$(pnpm store path)`, `pnpm
config list --json | jq`) from getting warnings mixed into the result.

- [`1c05876`](https://redirect.github.com/pnpm/pnpm/commit/1c05876):
Avoid relinking unchanged child dependencies and remove stale child
links during warm installs.

- [`817f99d`](https://redirect.github.com/pnpm/pnpm/commit/817f99d):
Fixed lockfile churn where a package's `transitivePeerDependencies`
could be dropped (and shift between packages) when the package
participates in a dependency cycle. A cycle re-entry resolves against
truncated children, so it must not be cached as "pure"; otherwise
sibling occurrences of the same package short-circuit and lose
transitive peers depending on traversal order
[#&#8203;5108](https://redirect.github.com/pnpm/pnpm/issues/5108).

- [`eba03e0`](https://redirect.github.com/pnpm/pnpm/commit/eba03e0): Fix
`pnpm install` reporting "Already up to date" after a catalog entry in
`pnpm-workspace.yaml` was reverted to a previous version. After an
update modified a catalog, the workspace state cache stored the
pre-update catalog versions, so reverting the entry back to its original
version was not detected as an outdated state
[#&#8203;12418](https://redirect.github.com/pnpm/pnpm/issues/12418).

- [`3b54d79`](https://redirect.github.com/pnpm/pnpm/commit/3b54d79):
`pnpm update` now keeps lockfile `overrides` that resolve through a
catalog in sync with the catalog. Previously, when an override
referenced a catalog (e.g. `overrides: { foo: 'catalog:' }`) and `pnpm
update` bumped that catalog entry, the lockfile's `catalogs` advanced
while the resolved `overrides` kept the old version. The resulting
lockfile was internally inconsistent, so a later `pnpm install
--frozen-lockfile` failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`.

- [`9d0a300`](https://redirect.github.com/pnpm/pnpm/commit/9d0a300):
Fixed `pnpm version --recursive` so it honors the workspace selection.
In recursive mode the version bump now applies to the packages resolved
from the workspace filter (`selectedProjectsGraph`), matching the
behavior of `pnpm publish --recursive`, instead of always bumping every
workspace package
[#&#8203;11348](https://redirect.github.com/pnpm/pnpm/issues/11348).

###
[`v11.7.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1170)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.6.0...v11.7.0)

##### Minor Changes

- Added a new setting `frozenStore` (`--frozen-store`) that lets `pnpm
install` run against a package store on a read-only filesystem (e.g. a
Nix store, a read-only bind mount, an OCI layer). When enabled, pnpm
opens the store's SQLite `index.db` through the `immutable=1` URI —
bypassing the WAL/`-shm` sidecar creation that otherwise fails on a
read-only directory — and suppresses every store-write path (the
`index.db` writer and the project-registry write). Pair it with
`--offline --frozen-lockfile` against a fully-populated store. Under the
global virtual store, package directories live inside the store, so if
the store is missing the build output of a package whose lifecycle
scripts are approved (or that has a patch), pnpm fails up front with
`ERR_PNPM_FROZEN_STORE_NEEDS_BUILD` rather than crashing mid-build on a
read-only write — seed the store with those builds first. Incompatible
with `--force` and with a configured pnpr server, since both write into
the store; the side-effects cache is likewise not written under
`frozenStore`. If the store is missing its content directory, the
install fails fast with `ERR_PNPM_FROZEN_STORE_INCOMPLETE` rather than
attempting to initialize it. The read-only `immutable=1` open requires
Node.js >=22.15.0, >=23.11.0, or >=24.0.0; on older runtimes
`--frozen-store` fails with a clear
`ERR_PNPM_FROZEN_STORE_UNSUPPORTED_NODE` error. Bin-linking also
tolerates a read-only store: under the global virtual store a package's
bin source lives inside the store, so the `chmod` that makes it
executable would be refused — with `EPERM`/`EACCES`, or with `EROFS` on
a genuinely read-only filesystem. That `chmod` is redundant when the
seed already ships its bins executable with a normalized shebang, so it
is now skipped in that case, while a non-executable bin (or one still
carrying a Windows CRLF shebang) on a read-only store still errors.
- When
[`pacquet`](https://redirect.github.com/pnpm/pnpm/tree/main/pacquet)
(the Rust port of pnpm) is declared in `configDependencies`, pnpm now
delegates dependency **resolution** to it too — not just materialization
— provided the installed pacquet is new enough to support full resolving
installs (>= 0.11.7).

Previously pacquet only ran in frozen-install mode: pnpm always resolved
the dependency graph itself (writing `pnpm-lock.yaml`) and handed
pacquet a finished lockfile to fetch / import / link. With pacquet >=
0.11.7, a non-frozen `pnpm install` (default isolated `nodeLinker`,
plain install) is delegated to pacquet end-to-end in a single pass —
pacquet resolves the manifests, writes the lockfile, and materializes
`node_modules`. pnpm detects the capability from the installed pacquet's
version; older pacquet releases keep the resolve-then-materialize split,
and `add` / `update` / `remove` still resolve in pnpm (it has to mutate
the manifests first). This remains an opt-in preview of the Rust install
engine
[#&#8203;11723](https://redirect.github.com/pnpm/pnpm/issues/11723).
- Added a new opt-in `--batch` flag to `pnpm publish --recursive` that
sends all selected packages to the registry in a single `PUT
/-/pnpm/v1/publish` request instead of one request per package. The
target registry has to implement the batch publish endpoint (pnpr does);
registries that don't are reported with a clear
`ERR_PNPM_BATCH_PUBLISH_UNSUPPORTED` error. The batch is processed
all-or-nothing by pnpr: if any package in the batch fails validation,
none of the packages are published.

##### Patch Changes

- Reject path-traversal and reserved dependency aliases (such as
`../../../escape`, `.bin`, `.pnpm`, or `node_modules`) that come from a
lockfile rather than a freshly resolved manifest. A crafted lockfile
alias could otherwise be joined directly under a hoisted `node_modules`
directory, letting package files be written outside the intended install
root or overwrite pnpm-owned layout.

  The fix adds two layers:

- The `nodeLinker: hoisted` graph builder now validates each alias at
the directory sink (`safeJoinModulesDir`), matching the validation pnpm
already performs when resolving aliases from manifests.
- The lockfile verification gate (`verifyLockfileResolutions`) now runs
an always-on, policy-independent check that rejects any importer or
snapshot dependency alias that is not a valid package name, failing the
install early — before any fetch or filesystem work — for every node
linker at once.

- Made shared package child resolution deterministic when the same
package is reached through multiple contexts. pnpm now chooses the
shallowest occurrence, then importer order, then parent path, instead of
letting request timing decide the child context and missing-peer report
[pnpm/pnpm#12358](https://redirect.github.com/pnpm/pnpm/issues/12358).

- Fix garbled summary line after submitting `pnpm update -i` and `pnpm
audit --fix -i`. The interactive checkbox prompt previously printed
every selected choice's full table row (label, current/target versions,
workspace, URL) joined by commas, producing a wall of text after
pressing Enter. The summary now lists only the selected package names
(or vulnerability keys) by setting an explicit `short` per choice; the
in-progress selection UI is unchanged.

- Prevent `pnpm patch-remove` from removing files outside the configured
patches directory.

- Fixed `pnpm publish` ignoring `strictSsl: false` when publishing to
registries with self-signed certificates. The `strictSSL` option is now
forwarded to `libnpmpublish` / `npm-registry-fetch` so that
`strict-ssl=false` in `.npmrc` or `strictSsl: false` in
`pnpm-workspace.yaml` is respected during publish, the same way it is
for `pnpm install`
[pnpm/pnpm#12012](https://redirect.github.com/pnpm/pnpm/issues/12012).

- Fixed `Cannot destructure property 'manifest' of
'manifestsByPath[rootDir]' as it is undefined` regression introduced in
11.6.0 when running `pnpm add <pkg>` outside a workspace on Windows.
`selectProjectByDir` was keying the resulting `ProjectsGraph` by
`opts.dir` instead of `project.rootDir`, so downstream `manifestsByPath`
lookups missed when the two paths normalized differently (typically
drive-letter casing).
[pnpm/pnpm#12379](https://redirect.github.com/pnpm/pnpm/issues/12379)

- Git dependencies that point to a subdirectory of a repository
(`repo#commit&path:/sub/dir`) keep their `path` in the lockfile again.
Since the integrity of git-hosted tarballs started being pinned in the
lockfile, any install that actually downloaded the tarball rebuilt the
lockfile resolution as `{ integrity, tarball, gitHosted }` and dropped
the `path` field, while installs served from the store kept it — so the
field disappeared seemingly at random. Without `path`, later installs
from that lockfile silently unpacked the repository root instead of the
subdirectory
[#&#8203;12304](https://redirect.github.com/pnpm/pnpm/issues/12304).

- Fixed nondeterministic lockfile output that made `pnpm dedupe --check`
fail intermittently in CI. When a locked peer provider was pinned for a
dependency that has no child dependencies of its own, the pinned
provider leaked into the shared parent scope, so siblings resolved after
it could pick up an optional peer they should not see. Which siblings
were affected depended on resolution order, which varies with network
timing.

- Sped up `pnpm install` with a frozen lockfile by running lockfile
verification (the policy revalidation gate added for
`minimumReleaseAge`/`trustPolicy` and the tarball-URL anti-tamper check)
concurrently with fetching and linking instead of blocking the whole
install on it. Dependency lifecycle scripts are still held back until
verification succeeds, so no script runs on an unverified lockfile: if
verification fails the install aborts before any dependency build, and
if linking finishes first the install waits for the verification verdict
before completing.

- User-defined `npm_config_*` environment variables are now preserved
during lifecycle script execution. Previously, all `npm_`-prefixed env
vars were stripped, which caused user-set variables like
`npm_config_platform_arch` to be lost
[pnpm/pnpm#12399](https://redirect.github.com/pnpm/pnpm/issues/12399).

- pnpm can now use different auth tokens for different package scopes,
even when those scopes use the same registry URL.

Previously, auth was selected only by registry URL. If `@org-a` and
`@org-b` both used `https://npm.pkg.github.com/`, they had to share the
same token. This caused problems for registries that issue tokens per
organization or per scope.

Configure a scope-specific token by adding the package scope after the
registry URL in the auth key:

  ```ini
  @&#8203;org-a:registry=https://npm.pkg.github.com/
  @&#8203;org-b:registry=https://npm.pkg.github.com/

  //npm.pkg.github.com/:@&#8203;org-a:_authToken=${ORG_A_TOKEN}
  //npm.pkg.github.com/:@&#8203;org-b:_authToken=${ORG_B_TOKEN}

  //npm.pkg.github.com/:_authToken=${FALLBACK_TOKEN}
  ```

`pnpm login --registry=https://npm.pkg.github.com --scope=@&#8203;org-a`
writes the token to the same scope-specific auth key.

When installing or publishing `@org-a/*`, pnpm uses `ORG_A_TOKEN`. For
`@org-b/*`, pnpm uses `ORG_B_TOKEN`. Packages without a matching scope
continue to use the registry-wide fallback token.

- `pnpm setup` no longer prompts to approve build scripts for
`@pnpm/exe` when installing the standalone executable. pnpm links the
platform-specific binary itself, so the package's install scripts are
skipped during the global self-install
[#&#8203;12377](https://redirect.github.com/pnpm/pnpm/issues/12377).

- Close lockfile reads deterministically before rewriting lockfiles and
keep pacquet's virtual store directory length aligned with pnpm on
Windows.

- A `304 Not Modified` answer from the registry now renews the cached
metadata file's mtime, so the `minimumReleaseAge` freshness shortcut
keeps serving resolutions from the cache. Previously, once a cached
packument grew older than `minimumReleaseAge`, every subsequent install
re-validated it against the registry forever, because a 304 never
rewrites the file.

- Updated dependency ranges. Notably:

  - `@pnpm/logger` peer dependency range moved to `^1100.0.0`.
- `msgpackr` 1.11.8 → 2.0.4 (store index files remain byte-compatible in
both directions).
- `open` ^7.4.2 → ^11.0.0, `memoize` ^10 → ^11, `cli-truncate` ^5 → ^6,
`pidtree` ^0.6 → ^1.
- `@yarnpkg/core` 4.5.0 → 4.8.0, `@rushstack/worker-pool` 0.7.7 →
0.7.18, `@cyclonedx/cyclonedx-library` 10.0.0 → 10.1.0,
`@pnpm/config.nerf-dart` ^1 → ^2, `@pnpm/log.group` 3.0.2 → 4.0.1,
`@pnpm/util.lex-comparator` ^3 → ^4.

- Updated `@zkochan/cmd-shim` to v9.0.6.

- Fixed a Windows-only hang where a failed command could take 20–46
seconds to exit. On error, pnpm enumerates descendant processes (via
`pidtree`) to terminate them, which on Windows shells out to
`wmic`/PowerShell `Get-CimInstance Win32_Process` — a lookup that is
extremely slow on some machines. The lookup is now bounded by a short
timeout so it can no longer stall the process exit.

###
[`v11.6.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1160)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.5.3...v11.6.0)

##### Minor Changes

- `pnpm install` completes without re-resolving when `pnpm-lock.yaml`
was deleted but `node_modules` is intact: the up-to-date check now
treats the current lockfile (`node_modules/.pnpm/lock.yaml`) — the
record of what the previous install materialized — as the wanted
lockfile, verifies the manifests still match it, restores
`pnpm-lock.yaml` from it, and reports "Already up to date". Previously
this scenario triggered a full resolution and a re-verification of every
locked package against the registry.

- [`615c669`](https://redirect.github.com/pnpm/pnpm/commit/615c669):
Added support for configuring URL-scoped registry settings through
`npm_config_//…` and `pnpm_config_//…` environment variables, for
example:

  ```text
  npm_config_//registry.npmjs.org/:_authToken=<token>
  pnpm_config_//registry.npmjs.org/:_authToken=<token>
  ```

This provides a file-free way to supply registry authentication. Because
the registry a value applies to is encoded in the (trusted) environment
variable name, it is host-scoped by construction and cannot be
redirected to another registry by repository-controlled config. The
environment value is treated as trusted config: it takes precedence over
a project/workspace `.npmrc` but is still overridden by command-line
options. When the same key is provided through both prefixes,
`pnpm_config_` wins.

- Raised the default network concurrency from `min(64, max(cpuCores * 3,
16))` to `min(96, max(cpuCores * 3, 64))`. Package downloads are
I/O-bound, not CPU-bound, so deriving the floor from the core count left
machines with few cores (for example 4-vCPU CI runners) downloading only
16 tarballs at a time and unable to saturate a low-latency registry. The
`networkConcurrency` setting still overrides the default.

##### Patch Changes

- Improved the warning printed when a project `.npmrc` uses an
environment variable in a registry/proxy URL or in registry credentials.
The message now explains why the setting was ignored and how to migrate
it to a trusted source — for example by moving the line to the
user-level `~/.npmrc` or running `pnpm config set "<key>" <value>` —
with a link to <https://pnpm.io/npmrc>. The `pnpm config set` example is
only suggested when the key has no `${...}` placeholder, so the snippet
is always safe to copy-paste.
- Print a "Lockfile passes supply-chain policies (verified 2h ago)"
message when lockfile verification is skipped because a cached verdict
for the same lockfile content and policy is reused. Previously the
cached short-circuit was completely silent, which made it look like the
policy gate never ran
[#&#8203;12324](https://redirect.github.com/pnpm/pnpm/issues/12324).
- Platform-specific optional dependencies are now skipped even when
their `os`/`cpu`/`libc` fields are missing from the registry metadata or
the lockfile. Some registries strip these fields from the package
metadata, which made pnpm download and install the binaries of every
platform regardless of `supportedArchitectures`. The missing platform
fields of an optional dependency are now inferred from its name (e.g.
`@nx/nx-win32-arm64-msvc` → `os: win32`, `cpu: arm64`), so
foreign-platform binaries are skipped without even downloading them
[#&#8203;11702](https://redirect.github.com/pnpm/pnpm/issues/11702).

###
[`v11.5.3`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1153)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.5.2...v11.5.3)

##### Patch Changes

- Stopped expanding environment variables in repository-controlled
registry/proxy request destinations and registry credential values from
`.npmrc`, and in workspace registry URLs from `pnpm-workspace.yaml`.
Move dynamic registry URL and token configuration to trusted user,
global, CLI, or environment config.

- Resolve package-manager bootstrap dependencies with trusted user or
CLI registry and network config, and reject package-manager env-lockfile
records that do not use registry package paths with integrity-only
resolutions before auto-switch execution.

- Avoid writing `packageManagerDependencies` to `pnpm-lock.yaml` when
package manager policy is set to `onFail: ignore` or `pmOnFail: ignore`
[#&#8203;12228](https://redirect.github.com/pnpm/pnpm/issues/12228).

- Avoid running dependency-status auto-install when the dependency
status is unavailable without a project manifest.

- Using the `$` version reference syntax in `overrides` (e.g. `"react":
"$react"`) now prints a deprecation warning. The syntax still works, but
[catalogs](https://pnpm.io/catalogs) are the recommended way to keep an
overridden version in sync with the rest of the workspace. Reference a
catalog entry with the `catalog:` protocol instead.

- Fixed `pnpm config get globalconfig` to return the global
`config.yaml` path again
[pnpm/pnpm#11962](https://redirect.github.com/pnpm/pnpm/issues/11962).

- Fixed bare `--color` so it does not consume the following CLI flag,
allowing command shorthands like `--parallel` to expand correctly and
forms like `pnpm --color with current <command>` to dispatch the inner
command instead of failing with `MISSING_WITH_CURRENT_CMD`.

- Fix `pnpm install` ignoring `enableGlobalVirtualStore` toggle by
including it in the workspace state settings check
[#&#8203;12142](https://redirect.github.com/pnpm/pnpm/issues/12142).

- Security: pnpm now verifies the npm registry signature of a
package-manager binary before spawning it, so a cloned repository cannot
make pnpm download and execute an arbitrary native binary.

This covers two paths that select an executable from
repository-controlled input:

- **pacquet install engine** — declaring `pacquet` (or `@pnpm/pacquet`)
in `configDependencies` opts in to pnpm's Rust install engine. pnpm now
verifies that the installed `pacquet` shim and the host's
`@pacquet/<platform>-<arch>` binary carry a valid npm registry signature
for their exact `name@version`, and refuses to run pacquet (failing the
command) if the signature does not verify or cannot be checked. The only
graceful fallback to pnpm's own engine is when pacquet has no binary for
the current platform.
- **automatic version switch / `self-update`** — the `packageManager` /
`devEngines.packageManager` field makes pnpm download and run a specific
pnpm version. pnpm now verifies the registry signature of `pnpm`,
`@pnpm/exe`, and the host platform binary before installing/spawning
them, and refuses to run an engine whose signature does not match a
published, signed release. The check runs only on an actual download
(store cache miss), so it does not add a network round trip to every
command.

In both cases the signature is verified over the *installed* integrity,
against npm's public signing keys that ship embedded in the pnpm CLI
(like corepack), so bytes substituted via a tampered lockfile or a
repository-controlled registry fail verification — and a registry the
user did not vouch for cannot supply its own signing keys. The signed
packument is fetched from the configured registry, so an npm mirror
works transparently. Verification fails closed: if it cannot be
completed (for example, the registry is unreachable), the command fails
rather than running an unverified binary. The embedded keys are kept
current by a release-time check against npm's signing-keys endpoint.

- Made peer-dependent deduplication deterministic. When a peer-suffixed
package variant was a subset of two or more mutually incompatible larger
variants, the variant it collapsed into depended on the order importers
were resolved in, which varies between machines. This could resolve the
same workspace to different lockfiles on different platforms and make
`pnpm dedupe --check` alternate between passing and failing.

- Reject invalid package names and versions from staged tarball
manifests before deriving filenames for `pnpm stage download`.

- Clarified in CLI help that the pnpm store is trusted shared state and
store integrity checks are corruption detection, not a tamper boundary
for untrusted store writers.

- Reject reserved manifest `bin` names (`""`, `"."`, `".."`, and scoped
forms such as `@scope/..`) when resolving a package's bins. These names
previously passed the bin-name guard and, when joined to the global bin
directory during global remove/update/add operations, could resolve to
the global bin directory itself or its parent and have it recursively
deleted.

- Require trusted package identity before package-name `allowBuilds`
entries can approve lifecycle scripts for git, git-hosted tarball,
direct tarball, and local directory artifacts. To approve one of those
artifacts explicitly, use its peer-suffix-free lockfile depPath as the
`allowBuilds` key. Lockfile verification now rejects lockfiles where a
registry-style dependency path (`name@semver`) is backed by a git,
directory, or git-hosted tarball resolution
(`ERR_PNPM_RESOLUTION_SHAPE_MISMATCH`), so the dependency path is a
reliable artifact identity by the time scripts can run.

- Security: pnpm now verifies the OpenPGP signature of a downloaded
Node.js runtime's `SHASUMS256.txt` before trusting its integrity hashes.

When a repository requests a Node.js runtime (e.g. via
`devEngines.runtime` / `useNodeVersion`), the download mirror is
repository-configurable through `node-mirror:<channel>`. The integrity
of the downloaded binary was only checked against `SHASUMS256.txt`
fetched from that same mirror — a circular check that a malicious mirror
could satisfy by serving a tampered binary together with a matching
`SHASUMS256.txt`. pnpm then executes the binary (for example to run
lifecycle scripts).

pnpm now fetches `SHASUMS256.txt.sig` and verifies the detached OpenPGP
signature against the Node.js release team's public keys, which ship
embedded in the pnpm CLI. A mirror that serves a tampered binary cannot
also produce a valid signature, so the download fails to verify. The
embedded keys are kept current by a release-time check against the
canonical `nodejs/release-keys` list.

The musl variants from the hardcoded `unofficial-builds.nodejs.org`
mirror are not repository-configurable and are signed by a different
key, so they continue to be trusted over TLS.

###
[`v11.5.2`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1152)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.5.1...v11.5.2)

##### Patch Changes

- Peer dependency resolution now reuses the peer contexts already
recorded in the lockfile when those providers are still present in the
dependency graph and still satisfy the peer ranges. This avoids
unnecessary peer-context rewrites during lockfile regeneration. Current
manifest choices remain authoritative: a newly added, explicitly
updated, or aliased direct provider, a changed nested provider, or a
locked version that no longer satisfies the range still takes
precedence.

- The lockfile verifier now checks that a registry entry pinning an
explicit `tarball` URL points at the artifact the registry's own
metadata lists for that `name@version`. Previously a tampered lockfile
could pair a trusted `name@version` with an attacker-chosen tarball URL
(and a matching integrity for those bytes), so the install fetched the
attacker's bytes. A mismatch — or any entry that can't be confirmed
against the registry — is rejected with `ERR_PNPM_TARBALL_URL_MISMATCH`.
Non-registry resolutions (`file:`, git-hosted, etc.) and registry
entries without an explicit tarball URL (the URL is reconstructed from
name+version+registry, so it is inherently bound) are unaffected;
non-standard registry tarball URLs (npm Enterprise, GitHub Packages)
still pass because they match the metadata.

- Fix `pnpm update --recursive --lockfile-only <pkg>@&#8203;<version>`
crashing with `Invalid Version` when the catalog entry for `<pkg>` is a
version range (e.g. `^21.2.10`) and `catalogMode` is `strict` or
`prefer`. The catalog–version comparison now skips the equality check
when either side is a range rather than passing a range to
`semver.eq()`, so range specifiers fall through to the existing mismatch
handling instead of throwing
[#&#8203;11570](https://redirect.github.com/pnpm/pnpm/issues/11570).

- Avoided a Node.js crash when pnpm exits after network requests on
Windows.

- Fixed packages being materialized into the virtual store without their
root-level files (`package.json`, `LICENSE`, README, root entrypoints)
when multiple `pnpm install` processes ran against the same
store/workspace concurrently. The fast import path used to destructively
empty the shared target directory, so a concurrent importer could wipe
files another importer had already written; if the surviving files
included the `package.json` completion marker, every later install
treated the broken directory as complete and never repaired it. The fast
path now imports directly only when it can create the target directory
exclusively, and otherwise builds the package in a private temp
directory and atomically renames it into place
[#&#8203;12197](https://redirect.github.com/pnpm/pnpm/issues/12197).

- Fix dependency build scripts not running under the global virtual
store (`enableGlobalVirtualStore`).

In a workspace install, dependency build scripts are deferred to a
single `rebuild` pass (`buildProjects`). That pass resolved each
package's location from the classic
`node_modules/.pnpm/<depPathToFilename>` layout, which does not exist
under the global virtual store — so native dependencies (e.g. packages
using `node-gyp` / `prebuild-install`) were never built and failed to
load at runtime (`Cannot find module .../build/Release/*.node`).

`buildProjects` now resolves the global-virtual-store projection
directory (`<storeDir>/links/<hash>`, computed with the same graph hash
the installer uses) when `enableGlobalVirtualStore` is set, and
serializes concurrent builds of the same shared projection so parallel
workspace projects don't race on the same directory.

- Don't promote a `runtime:` dependency (such as the Node.js version
from `devEngines.runtime` or `pnpm runtime set`) into a catalog when
`catalogMode` is `strict` or `prefer`. A `runtime:` dependency
round-trips to `devEngines.runtime`, which only recognizes the
`runtime:` protocol; cataloging it rewrote the manifest entry to
`catalog:`, which broke that round-trip, stranded it in
`devDependencies`, and left `devEngines.runtime` untouched.

- Skip lockfile `minimumReleaseAge`/`trustPolicy` verification for
non-registry tarball protocols (for example `file:`), so local tarball
dependencies are not incorrectly checked against npm registry metadata.

###
[`v11.5.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1151)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.5.0...v11.5.1)

##### Patch Changes

- Improve `pnpm audit` performance by pruning non-vulnerable lockfile
subtrees and stopping path enumeration once vulnerable findings reach
the path cap.
- Avoid crashing when the workspace state cache is partially written or
malformed.
- Set `npm_config_user_agent` for root lifecycle scripts during headless
installs.
- Preserve the `integrity` field of a remote (non-registry) tarball
dependency when its lockfile entry is rebuilt. Re-resolving such a
dependency without re-fetching it (for example via `pnpm update`, or
when another dependency changes) produced a resolution with no integrity
— URL/tarball resolvers only learn the integrity after the tarball is
downloaded — so the previously recorded integrity was dropped, making
later installs fail with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`
[#&#8203;12067](https://redirect.github.com/pnpm/pnpm/issues/12067).
- Normalize a string `repository` field into the `{ type, url }` object
form when creating the publish manifest, matching npm's behavior. Some
registries (e.g. Gitea/Codeberg) reject a string `repository` with a 500
Internal Server Error during `pnpm publish`
[#&#8203;12099](https://redirect.github.com/pnpm/pnpm/issues/12099).
- Preserve compatible optional peer versions already present in the
lockfile when resolving dependencies.
- Fixed inconsistent resolution of a peer dependency that is shared
through a diamond. When a package peer-depends on both another package
and one of that package's own peer dependencies (for example
`@typescript-eslint/eslint-plugin` peer-depends on both
`@typescript-eslint/parser` and `typescript`, and
`@typescript-eslint/parser` peer-depends on `typescript`), pnpm no
longer reuses a hoisted instance of the shared peer that was resolved
against a different version
[#&#8203;12079](https://redirect.github.com/pnpm/pnpm/issues/12079).

###
[`v11.5.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1150)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.4.0...v11.5.0)

##### Minor Changes

- Added a new `hoistingLimits` setting for `nodeLinker: hoisted`
installs, mirroring yarn's `nmHoistingLimits`. It accepts `none` (the
default — hoist as far as possible), `workspaces` (hoist only as far as
each workspace package), or `dependencies` (hoist only up to each
workspace package's direct dependencies). Originally proposed in
[#&#8203;6468](https://redirect.github.com/pnpm/pnpm/pull/6468), closing
[#&#8203;6457](https://redirect.github.com/pnpm/pnpm/issues/6457).

- Replaced `enquirer` with `@inquirer/prompts` for all interactive
prompts. Fixes the `update -i` scrolling overflow bug where long choice
lists were clipped in the terminal
[#&#8203;6643](https://redirect.github.com/pnpm/pnpm/issues/6643).

  **User-facing changes:**

- `pnpm update -i` / `pnpm update -i --latest`: Scrolling now works
correctly when many packages are available; the new library uses
visual-line-aware pagination via `usePagination`
- `pnpm audit --fix -i`: Same scrolling fix for vulnerability selection
  - `pnpm approve-builds`: Interactive build approval prompts updated
  - `pnpm patch`: Version selection and "apply to all" prompts updated
  - `pnpm patch-remove`: Patch removal selection updated
  - `pnpm publish`: Branch confirmation prompt updated
  - `pnpm login`: Credential prompts updated
- `pnpm run` / `pnpm exec` (with `verifyDepsBeforeRun=prompt`):
Confirmation prompt updated

Vim-style `j`/`k` keys still work for up/down navigation in all
interactive prompts.

**Internal:** The `OtpEnquirer` and `LoginEnquirer` DI interfaces
changed from `{ prompt }` to `{ input }` / `{ input, password }`
respectively. Plugins or custom builds that inject their own enquirer
mock will need to update.

- Staged publishes are now recognized in the trust scale. When a package
version's registry metadata carries an `approver` field, it is treated
as the strongest trust evidence (ranked above trusted publishers and
provenance attestations), since staged publishes require 2FA publish
approvals. This prevents false-positive trust downgrade errors when
moving from a staged publish to a lower trust level
[#&#8203;11887](https://redirect.github.com/pnpm/pnpm/issues/11887).

##### Patch Changes

- Fix pnpm hanging during peer resolution when an aliased install pulls
in transitive packages with mutual peer cycles at different depths in
the dependency tree (for example, `pnpm i nuxt@npm:nuxt-nightly@5x`).
Cycles whose members hit the `findHit` cache instead of running their
own `calculateDepPath` are now short-circuited by sibling resolutions at
the level where the cycle is detected, so the cached path promises no
longer deadlock.
[#&#8203;11999](https://redirect.github.com/pnpm/pnpm/issues/11999).
- Fix `pnpm dist-tag add` and `pnpm dist-tag rm` against npmjs.org
failing without `--otp` with `[ERR_PNPM_UNAUTHORIZED] You must be logged
in to set dist-tag … "You must provide a one-time pass. Upgrade your
client to npm@latest in order to use 2FA."`. pnpm now sends
`npm-auth-type: web` on dist-tag writes and surfaces the resulting OTP
challenge through the existing browser-based 2FA flow (the same
`withOtpHandling` helper used by `pnpm publish`), so the browser opens,
the user authenticates, and the dist-tag is set on retry. `--otp=<code>`
continues to work via the classic flow.
- Fix `minimumReleaseAgeExclude` handling in npm resolution fast paths
so excluded packages do not get pinned to stale versions. Excludes are
honored consistently during `publishedBy` metadata selection and
cache-mtime shortcuts.
- Fix the `integrity` field being dropped from the lockfile entry of a
remote (non-registry) https-tarball dependency when an unrelated package
is installed afterwards. URL/tarball resolvers do not return an
integrity (it is only known after the tarball is downloaded), so when
such a dependency was reused from the lockfile without being re-fetched,
its integrity was lost. It is now carried over from the existing
resolution. With pnpm's lockfile-integrity hardening, the missing
integrity made subsequent `--frozen-lockfile` installs fail with
`ERR_PNPM_MISSING_TARBALL_INTEGRITY`.
[#&#8203;12001](https://redirect.github.com/pnpm/pnpm/issues/12001).
- Skip dependency re-resolution when `pnpm-lock.yaml` is missing but
`node_modules/.pnpm/lock.yaml` exists and still satisfies the manifest.
`pnpm install` now reuses the materialized snapshot to regenerate
`pnpm-lock.yaml` instead of walking the registry to rebuild it from
scratch, turning the cache+node\_modules variation into a near-no-op for
users who deleted the lockfile but kept the install
[#&#8203;11993](https://redirect.github.com/pnpm/pnpm/issues/11993).

`--frozen-lockfile` still refuses to proceed when `pnpm-lock.yaml` is
absent — the regenerated lockfile must be committed, so failing loudly
is the correct behavior for CI.

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on the first day of the month"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-01 01:42:59 +00:00
renovate[bot] a17a9ff565 chore(deps): update dependency oxlint-tsgolint to v0.24.0 (#23980) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) |
[`0.23.0` →
`0.24.0`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.23.0/0.24.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.24.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.24.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.23.0/0.24.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.23.0/0.24.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

###
[`v0.24.0`](https://redirect.github.com/oxc-project/tsgolint/compare/v0.23.0...5a37e8902f65440900be1436b814919fcdb4e3d4)

[Compare
Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.23.0...v0.24.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-30 14:07:34 +00:00
renovate[bot] 35be063790 chore(deps): update dependency oxfmt to ^0.57.0 (#23965) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.56.0` →
`^0.57.0`](https://renovatebot.com/diffs/npm/oxfmt/0.56.0/0.57.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.57.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.57.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.56.0/0.57.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.56.0/0.57.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.57.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.56.0...oxfmt_v0.57.0)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.56.0...oxfmt_v0.57.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-30 02:01:31 +00:00
renovate[bot] 5d55de1d32 chore(deps): update oxc apps (#23714) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.55.0` →
`^0.56.0`](https://renovatebot.com/diffs/npm/oxfmt/0.55.0/0.56.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.56.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.56.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.55.0/0.56.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.55.0/0.56.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.56.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.55.0...oxfmt_v0.56.0)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.55.0...oxfmt_v0.56.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzUuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIzNS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-22 18:42:34 +02:00
renovate[bot] 24568b41ba chore(deps): update oxc apps to ^0.55.0 (#23453) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.54.0` →
`^0.55.0`](https://renovatebot.com/diffs/npm/oxfmt/0.54.0/0.55.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.55.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.55.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.54.0/0.55.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.54.0/0.55.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.55.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0550---2026-06-15)

##### 🚀 Features

-
[`9a2788b`](https://redirect.github.com/oxc-project/oxc/commit/9a2788b)
linter/unicorn: Implement `prefer-export-from` rule
([#&#8203;22935](https://redirect.github.com/oxc-project/oxc/issues/22935))
(AliceLanniste)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-15 14:24:24 +00:00
renovate[bot] 0c19c0eb19 chore(deps): update oxc apps to ^0.54.0 (#23120) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.53.0` →
`^0.54.0`](https://renovatebot.com/diffs/npm/oxfmt/0.53.0/0.54.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.54.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.54.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.53.0/0.54.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.53.0/0.54.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.54.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0540---2026-06-08)

##### 📚 Documentation

-
[`dadafe3`](https://redirect.github.com/oxc-project/oxc/commit/dadafe3)
oxlint, oxfmt: Mention migrate skills in npm READMEs
([#&#8203;22965](https://redirect.github.com/oxc-project/oxc/issues/22965))
(Boshen)
-
[`f88961a`](https://redirect.github.com/oxc-project/oxc/commit/f88961a)
oxfmt: Annotate each config option with supported languages
([#&#8203;22953](https://redirect.github.com/oxc-project/oxc/issues/22953))
(leaysgur)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDkuNCIsInVwZGF0ZWRJblZlciI6IjQzLjIwOS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-08 15:15:49 +00:00
renovate 9569dd3252 chore(deps): update dependency oxfmt to ^0.53.0 (#22897) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt)) | [`^0.52.0` → `^0.53.0`](https://renovatebot.com/diffs/npm/oxfmt/0.52.0/0.53.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.53.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.53.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.52.0/0.53.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.52.0/0.53.0?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

### [`v0.53.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.52.0...oxfmt_v0.53.0)

[Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.52.0...oxfmt_v0.53.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDYuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIwNi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-06-01 17:59:30 +00:00
renovate[bot] a7379eb6a5 chore(deps): update pnpm to v11.4.0 (#22870) 
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) |
[`11.0.4` →
`11.4.0`](https://renovatebot.com/diffs/npm/pnpm/11.0.4/11.4.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.4.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/11.4.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/11.0.4/11.4.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.0.4/11.4.0?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v11.4.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1140)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.3.0...v11.4.0)

##### Minor Changes

- Treat tarball-integrity mismatches against the lockfile as a hard
failure by default. Previously, `pnpm install` (non-frozen) would log
`ERR_PNPM_TARBALL_INTEGRITY`, silently re-resolve from the registry, and
overwrite the locked integrity — which meant a compromised registry,
proxy, or republished version could substitute attacker-controlled
content on a clean machine even though the project shipped a committed
lockfile.

`pnpm install` now exits with `ERR_PNPM_TARBALL_INTEGRITY` and a hint
pointing at the new opt-in flag.

The only opt-in is **`pnpm install --update-checksums`** — narrowly
scoped to refreshing the locked integrity values from what the registry
currently serves. Mirrors yarn's flag of the same name. A warning still
prints when the bypass takes effect so the operation is auditable.

`--force` and `pnpm update` deliberately do **not** bypass the integrity
check. They are routine refresh operations; silently overwriting a
locked integrity in those flows would erase the protection a committed
lockfile is supposed to provide. `--frozen-lockfile` behavior is
unchanged. `--fix-lockfile` keeps its documented purpose (filling in
missing lockfile entries) and is also not a bypass.

- `pnpm runtime set <name> <version>` now saves the runtime to
`devEngines.runtime` by default instead of `engines.runtime`. Pass
`--save-prod` (or `-P`) to save it to `engines.runtime` instead
[#&#8203;11948](https://redirect.github.com/pnpm/pnpm/issues/11948).

##### Patch Changes

- Fix a credential disclosure issue where an unscoped `_authToken` (or
`_auth`, or `username` + `_password`, or `tokenHelper`) defined in one
source — `~/.npmrc`, `~/.config/pnpm/auth.ini`, a workspace `.npmrc`,
CLI flags, etc. — would be sent as an `Authorization` header to
whichever registry a different (potentially untrusted) source named. The
same fix extends to client TLS credentials (`cert`, `key`) so they
aren't presented to a registry their author didn't choose.

pnpm now rewrites each unscoped per-registry setting (`_authToken`,
`_auth`, `username`, `_password`, `tokenHelper`, `cert`, `key`) to its
URL-scoped form at load time, using the `registry=` value declared in
the same source (or the npmjs default registry if the source declares
none). A later layer overriding `registry=` therefore cannot pull an
unscoped credential along, because it is already pinned to the URL its
author intended. `ca`/`cafile` are intentionally not rescoped — they're
trust anchors, not credentials, and corporate MITM-proxy setups rely on
them applying globally.

Every rescope emits a deprecation warning telling the user where the
setting was pinned and how to write it directly. npm has rejected
unscoped credentials outright since `npm@9`, and pnpm intends to remove
support in a future major release. To target a specific registry, write
the setting URL-scoped (e.g. `//registry.example.com/:_authToken=...` or
`//registry.example.com/:cert=...`).

`@pnpm/network.auth-header`: removed the `defaultRegistry` parameter
from `createGetAuthHeaderByURI` and `getAuthHeadersFromCreds`. Now that
credentials are URL-scoped at load time, the merged `configByUri` never
contains the empty-string "default registry" placeholder slot, so
re-keying it onto the merged default registry is no longer needed.

- Fix `pnpm deploy` crashing with `ENOENT: ... lstat
'<deployDir>/node_modules'` when `configDependencies` declares pacquet
(`pacquet` or `@pnpm/pacquet`). The deploy directory never installs
config dependencies, so the install engine they designate isn't on disk
to invoke; the nested install now skips them.

- Reject git resolutions whose `commit` field is not a 40-character
hexadecimal SHA before invoking `git`. A malicious lockfile could
otherwise smuggle a value such as `--upload-pack=<command>` through `git
fetch` / `git checkout`, which on SSH or local-file transports executes
the supplied command.

- Limit concurrent project manifest reads while listing large workspaces
to avoid `EMFILE` errors.

- Reject patch files whose `diff --git` headers reference paths outside
the patched package directory. Previously a malicious `.patch` file
added via a pull request could write, delete, or rename arbitrary files
reachable by the user running `pnpm install`.

- Improve the log message that pnpm prints after auto-adding entries to
`minimumReleaseAgeExclude` when `minimumReleaseAge` is set without
`minimumReleaseAgeStrict`. The message previously referred to the
internal "loose mode" terminology, which wasn't searchable in the docs;
it now tells the user to set `minimumReleaseAgeStrict` to `true` if they
want these updates gated behind a prompt instead
[#&#8203;11747](https://redirect.github.com/pnpm/pnpm/issues/11747).

- Reject dependency aliases that contain path-traversal segments (such
as `@x/../../../../../.git/hooks`) when reading them from a package
manifest or symlinking them into `node_modules`. A malicious registry
package could otherwise use a transitive dependency key to make `pnpm
install` create symlinks at attacker-chosen paths outside the intended
`node_modules` directory.

- Reject `pnpm-lock.yaml` entries whose remote tarball `resolution:`
block is missing the `integrity` field. Previously the worker that
extracts a downloaded tarball skipped hash verification when no
integrity was supplied and minted a fresh one from the unverified bytes,
so an attacker who could both alter the lockfile (e.g. via a pull
request that strips `integrity:`) and serve modified content at the
referenced tarball URL could install a tampered package without any
error — including under `--frozen-lockfile`. pnpm now fails closed at
lockfile-read time with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`. Git-hosted
tarballs (`gitHosted: true` or a URL on codeload.github.com /
bitbucket.org / gitlab.com) and `file:` tarballs are exempt — the commit
SHA in a git-host URL and the user-controlled local path already anchor
the bytes.

- Validate `devEngines.runtime` and `engines.runtime` version ranges for
`node`, `deno`, and `bun` when `onFail` is set to `error` or `warn`.
Previously these settings only had an effect with `onFail: 'download'` —
the `error` and `warn` modes silently did nothing
[#&#8203;11818](https://redirect.github.com/pnpm/pnpm/issues/11818).
Violations now throw `ERR_PNPM_BAD_RUNTIME_VERSION`.

- Require provenance before treating trusted publisher metadata as the
strongest trust evidence.

###
[`v11.3.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1130)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.2.2...v11.3.0)

##### Minor Changes

- Added `pnpm stage` with `publish`, `list`, `view`, `approve`,
`reject`, and `download` subcommands for npm staged publishing.
- Added a new setting `trustLockfile`. When `true`, `pnpm install` skips
the supply-chain verification pass that re-applies `minimumReleaseAge` /
`trustPolicy='no-downgrade'` to every entry in the loaded lockfile. The
install treats the lockfile as already-trusted — useful for
closed-source projects where every commit comes from a trusted author.
Defaults to `false`; verification stays on by default. Set in
`pnpm-workspace.yaml`.

Also cut the memory footprint of the verification pass itself: the
per-(registry, name) trust-meta cache previously retained the full
packument — dependency graphs, scripts, README, and per-version
manifests — for the entire install. On large workspaces (`~4k` lockfile
entries with `minimumReleaseAge` + `trustPolicy: no-downgrade` enabled)
this could OOM CI runners with a 2GB heap cap. The cache now stores only
the fields the trust check actually reads (`time`, per-version
`_npmUser.trustedPublisher`, `dist.attestations.provenance`). The
abbreviated-metadata cache is similarly projected to just the
package-level `modified` field and the set of currently-listed version
names. Fixes
[#&#8203;11860](https://redirect.github.com/pnpm/pnpm/issues/11860).
- Implemented `pnpm pkg` command natively, following `npm pkg`
standards.
- Implemented `pnpm repo` command natively, following `npm repo`
standards.
- Implemented `pnpm set-script` (alias `ss`) natively. Adds or updates
an entry in the `scripts` field of the project manifest, supporting
`package.json`, `package.json5`, and `package.yaml` formats.
- Add a `skip-manifest-obfuscation` option for `pnpm pack` and `pnpm
publish`. When enabled, the original `packageManager` field and publish
lifecycle scripts are kept in the packed/published manifest instead of
being stripped. The pnpm-specific `pnpm` field continues to be omitted.

##### Patch Changes

- Fixed `pnpm dlx` failing with `ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND`
when the installed package's CAS slot is missing its `package.json`.
Observed in the wild for `pnpm dlx node@runtime:<version>` when the GVS
slot was populated without the synthesized manifest runtime archives
need (they don't ship a `package.json` of their own, so the synthesized
one is the only way it gets there; an existing slot from an earlier code
path that skipped the synthesis stays incomplete). The bin link itself
is wired up from the resolution and remains valid, so `dlx` now falls
back to the scopeless package name when the slot's manifest is
unreadable — for single-bin packages (the dlx common case, including
every `runtime:` spec) this matches what `manifest.bin` would have
named. Multi-bin packages already require `--package=<spec> <bin>` to
disambiguate and don't enter this code path.
- Fixed non-determinism in `pnpm dedupe` and `pnpm install` when a
dependency graph contains packages with transitive peer dependencies on
each other (e.g. `@aws-sdk/client-sts` and `@aws-sdk/client-sso-oidc`)
and `auto-install-peers` is enabled. The lockfile no longer flips
between two equally-valid forms across consecutive runs. The root cause
was that `resolveDependencies` pushed onto its `pkgAddresses` /
`postponedResolutionsQueue` arrays from inside `Promise.all`-spawned
callbacks, so completion-order timing leaked into the array order and
downstream cyclic-peer suffix assignment. Fixes
[#&#8203;8155](https://redirect.github.com/pnpm/pnpm/issues/8155).
- Fixed a regression introduced by
[#&#8203;11711](https://redirect.github.com/pnpm/pnpm/pull/11711) where
`pnpm add <github-shorthand>` (and any other wanted-dependency whose
alias can't be parsed from the user-supplied spec, e.g. tarball URLs or
`pnpm/test-git-fetch#sha`) was silently dropped from the manifest update
and from `pendingBuilds`. The alias-keyed lookup added in that PR
couldn't find a `wantedDependency` whose `alias` was `undefined` at
parse time but resolved to a package name only after fetching, so the
entry never made it into `specsToUpsert`. Restored the original
index-based pairing between `directDependencies` and
`wantedDependencies`; the catalog-protocol preservation that PR was
originally fixing is unaffected because it's driven by
`rdd.catalogLookup.userSpecifiedBareSpecifier`, not by the lookup. Fixes
the three `rebuilds dependencies` / `rebuilds specific dependencies` /
`rebuild with pending option` failures in
`building/commands/test/build/index.ts`.
- Fixed `pnpm add --config` leaving orphan entries in
`pnpm-lock.env.yaml` (the optional subdependencies of the previously
resolved version of the updated config dependency).

###
[`v11.2.2`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1122)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.2.1...v11.2.2)

##### Patch Changes

- When the install engine is delegated to pacquet via
`configDependencies`, the user's CLI flags passed to `pnpm install`
(e.g. `--no-runtime`, `--prod`, `--dev`, `--no-optional`,
`--node-linker`, `--cpu`/`--os`/`--libc`, `--offline`,
`--prefer-offline`) are now forwarded to pacquet's `install` subcommand
verbatim. Previously pacquet was invoked with a fixed argument list, so
flags like `--no-runtime` were silently dropped. Flag forwarding is
gated on the command being `install`/`i`; `add`, `update`, and `dedupe`
still don't forward (their flag surface doesn't line up with pacquet's
`install`).
- Fixed `pnpm up` (and `pnpm add` / `pnpm remove`) failing with
`pacquet_package_manager::outdated_lockfile` when pacquet is declared in
`configDependencies`. pnpm now passes `--ignore-manifest-check` to
pacquet so its `--frozen-lockfile` check doesn't fire against the
(pre-mutation) `package.json` pnpm hasn't written yet
[#&#8203;11797](https://redirect.github.com/pnpm/pnpm/issues/11797).
Requires a pacquet release that supports the flag — bump
`PACQUET_VERSION` in the e2e tests once it ships.

###
[`v11.2.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1121)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.2.0...v11.2.1)

##### Patch Changes

- Mark optional subdependency snapshots of config dependencies with
`optional: true` in the env lockfile, matching how optional dependencies
are recorded elsewhere in `pnpm-lock.yaml`. Previously, snapshots for
the platform-specific subdeps pulled in via a config dep's
`optionalDependencies` were written as empty objects, which was
inconsistent with the rest of the lockfile and made it look like those
non-host platform variants were required.
- Fix `pickRegistryForPackage` returning the wrong registry for an
unscoped `npm:` alias under a scoped local name. A manifest entry like
`"@&#8203;private/foo": "npm:lodash@^1"` was routing the `lodash` fetch
through `registries["@&#8203;private"]`, even though `lodash` is
unscoped and doesn't live on that registry. The npm-alias branch now
returns the alias target's own scope (or `null` for an unscoped target,
falling through to `registries.default`) instead of leaking into the
local key's scope.
- Don't print "Installing config dependencies..." when config
dependencies are already installed and nothing needs to be fetched,
re-linked, or removed.

###
[`v11.2.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1120)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.1.3...v11.2.0)

##### Minor Changes

- **Experimental:** Adding
[`@pnpm/pacquet`](https://npmx.dev/package/@&#8203;pnpm/pacquet) (the
Rust port of pnpm) to `configDependencies` in `pnpm-workspace.yaml` now
delegates the materialization phase of `pnpm install` to the pacquet
binary. pnpm still owns dependency resolution; pacquet only fetches and
imports from the freshly-written lockfile. This is an opt-in preview of
the Rust install engine
[#&#8203;11723](https://redirect.github.com/pnpm/pnpm/issues/11723).

  To configure pacquet in a project, run:

  ```
  pnpm add @&#8203;pnpm/pacquet --config
  ```

You'll see changes in `pnpm-workspace.yaml` and `pnpm-lock.yaml` that
should be committed. If you experience any issues with pacquet, please
let us know by mentioning this in the GitHub issue you create.

- `configDependencies` now resolve and install one level of
`optionalDependencies` declared by the config dependency, with
`os`/`cpu`/`libc` platform filtering applied at install time. This
unlocks the esbuild/swc-style pattern where a package ships
platform-specific binaries via `optionalDependencies` — a config
dependency can now do the same and have the matching binary symlinked
next to it in the global virtual store, so
`require('pkg-platform-arch')` from inside the config dependency
resolves correctly.

The env lockfile records all platform variants regardless of host
platform, so it remains portable across machines. Each entry in a config
dependency's `optionalDependencies` must declare an exact version —
ranges and tags are rejected to keep installs reproducible.

- Implement the documented `pnpm login --scope <scope>` flag. The scope
is normalized (a leading `@` is added if missing; blank values are
ignored) and an `@<scope>:registry=<registry>` mapping is written to the
pnpm auth file alongside the auth token. Subsequent installs of
`@<scope>/*` packages then route to the chosen registry. Previously
`pnpm login --scope foo` errored with `Unknown option: 'scope'` despite
the flag being listed in the online documentation
[#&#8203;11716](https://redirect.github.com/pnpm/pnpm/issues/11716).

- `pnpm outdated` and `pnpm update --interactive` now report Node.js,
Deno, and Bun runtimes installed as project dependencies (`runtime:`
specifiers). Previously these were silently skipped.

##### Patch Changes

- Fix `cafile=<relative-path>` in `.npmrc` being read from the wrong
directory when pnpm is invoked from a different cwd (e.g. `pnpm --dir
<project> install` from a CI wrapper or monorepo script). The path is
now resolved against the directory of the `.npmrc` that declared it, not
`process.cwd()`. Before this fix the CA file silently failed to load —
the install proceeded without the configured CA and the user only saw
TLS errors against a private registry, with no log line tying back to
the wrongly resolved path
[#&#8203;11624](https://redirect.github.com/pnpm/pnpm/issues/11624).

- Fix `config.registry` getting a trailing slash appended when
`registry` is set in `.npmrc` and no `registries.default` is provided by
`pnpm-workspace.yaml`. The sync from `registries.default` to
`config.registry` introduced in
[#&#8203;11744](https://redirect.github.com/pnpm/pnpm/issues/11744) now
only fires when the workspace manifest actually contributes a different
default.

- Fix global add/update to handle minimumReleaseAge policy violations
instead of surfacing an internal resolver guardrail error.

- Fix two crashes with `injectWorkspacePackages: true` when the lockfile
has been pruned (e.g. by `turbo prune --docker`):

- `Cannot use 'in' operator to search for 'directory' in undefined`: a
peer-dependency-variant injected snapshot inherits its `resolution` from
the base `packages:` entry; when a pruner drops that base entry the
readers crash. `convertToLockfileObject` now reconstructs the directory
resolution from the `file:` depPath at load time — a single
normalization point, so every reader sees a fully-formed snapshot.
- `ERR_PNPM_ENOENT` on `node_modules/.bin/<tool>`: after
`prepare`/`postinstall`, `runLifecycleHooksConcurrently` re-imported
each injected workspace package; the `scanDir`-into-`filesMap`
workaround fed target-internal paths to the importer, which the
`makeEmptyDir` fast path
([#&#8203;11088](https://redirect.github.com/pnpm/pnpm/issues/11088))
then wiped. Drop the workaround and pass `keepModulesDir: true` so the
importer preserves the target's existing `node_modules` (bin links +
transitive deps) and source files keep their hardlinks.

- Fixed `pnpm login` and `pnpm logout` ignoring `registries.default`
from `pnpm-workspace.yaml`
[#&#8203;10099](https://redirect.github.com/pnpm/pnpm/issues/10099).

- Fix the `minimumReleaseAge` (publishedBy) maturity shortcut to be
inclusive at the cutoff. Previously, abbreviated metadata whose
`modified` field equalled the cutoff fell off the fast path and
triggered a full-metadata re-fetch (or a `MISSING_TIME` error when full
metadata wasn't permitted). Since `modified` is an upper bound on every
version's publish time, `modified == publishedBy` already implies every
version passes the per-version `<=` filter in
`filterPkgMetadataByPublishDate`, so the shortcut now accepts the
boundary case directly. Strictly `>` (was `>=`) at the rejection branch.

- Honor `publishConfig.access` when publishing packages.

###
[`v11.1.3`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1113)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.1.2...v11.1.3)

##### Patch Changes

- `pnpm install` now re-validates `pnpm-lock.yaml` entries against the
active `minimumReleaseAge` and `trustPolicy: 'no-downgrade'` policies
before any tarball is fetched. Lockfiles resolved elsewhere (committed
to the repo, restored from a CI cache, produced by an older pnpm) under
a weaker or absent policy can no longer install a freshly-published or
trust-downgraded version silently. Violating entries abort the install
with `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION`,
`ERR_PNPM_TRUST_DOWNGRADE`, or the generic
`ERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION` when both policies trip in
the same batch; `minimumReleaseAgeExclude` and `trustPolicyExclude` are
honored. Verification results are cached so repeat installs against an
unchanged lockfile take a fast path, and pnpm shows a transient progress
line while the registry round-trip runs.

When fresh resolution picks an immature version, the behavior depends on
`minimumReleaseAgeStrict`:

- **Loose mode** — the default, in effect whenever `minimumReleaseAge`
keeps its built-in 24-hour value — auto-adds the immature picks to
`minimumReleaseAgeExclude` in `pnpm-workspace.yaml` and lets the install
proceed. A single info message lists what was persisted.
- **Strict mode** in an interactive terminal collects every immature
direct AND transitive pick in one pass and prompts once with the full
list. Approving adds them to `minimumReleaseAgeExclude` and the install
continues; declining aborts before the lockfile, `package.json`, or
`node_modules` is touched.
- **Strict mode** in CI (or any non-TTY context) aborts with
`ERR_PNPM_NO_MATURE_MATCHING_VERSION` listing every offending entry,
instead of failing on the first one the resolver hit.

`minimumReleaseAgeStrict` auto-enables whenever the user explicitly sets
`minimumReleaseAge` (CLI flag, env var, global `config.yaml`, or
`pnpm-workspace.yaml`); set `minimumReleaseAgeStrict: false` to keep
loose-mode auto-collect even with an explicit `minimumReleaseAge` value.
Closes
[#&#8203;10438](https://redirect.github.com/pnpm/pnpm/issues/10438),
[#&#8203;10488](https://redirect.github.com/pnpm/pnpm/issues/10488),
[#&#8203;11687](https://redirect.github.com/pnpm/pnpm/issues/11687).

- Allow redundant trailing base64 padding in `.npmrc` auth values and
report invalid auth base64 with a pnpm error.

- Make `pnpm self-update` respect `minimumReleaseAge` (and
`minimumReleaseAgeExclude`) when resolving which pnpm version to
install.

When the `latest` dist-tag points to a version newer than the configured
age threshold, `self-update` now selects the newest mature version
instead unless excluded by `minimumReleaseAgeExclude`.

Also makes `dlx` and `outdated` surface invalid
`minimumReleaseAgeExclude` patterns under the same
`ERR_PNPM_INVALID_MINIMUM_RELEASE_AGE_EXCLUDE` error code already used
by `install`, instead of leaking the internal
`ERR_PNPM_INVALID_VERSION_UNION` /
`ERR_PNPM_NAME_PATTERN_IN_VERSION_UNION` codes.

- Global installs respect global config build policy (e.g.,
`dangerouslyAllowAllBuilds` from config.yaml) when GVS is enabled
[#&#8203;9249](https://redirect.github.com/pnpm/pnpm/issues/9249).

The global virtual-store (GVS) default `allowBuilds = {}` was applied
before workspace manifest settings were read and before global config
values (stripped by `extractAndRemoveDependencyBuildOptions`) were
re-applied via `globalDepsBuildConfig`. This caused
`hasDependencyBuildOptions` to return `true` (because `{}` is not null),
blocking restoration of global config values like
`dangerouslyAllowAllBuilds`. As a result, global installs skipped all
build scripts even when the config explicitly allowed them.

This fix moves the GVS default to **after** workspace manifest reading
and `globalDepsBuildConfig` re-application, so that:

  1. Workspace manifest `allowBuilds` takes precedence (if present)
2. Global config `dangerouslyAllowAllBuilds` is properly restored (if
set and no workspace policy exists)
3. Empty `{}` is only applied as a last resort when no policy is
configured anywhere

- Honor `--silent` when `verifyDepsBeforeRun: install` auto-installs
dependencies before `pnpm run` or `pnpm exec`, preventing install output
from being written to stdout
[#&#8203;11636](https://redirect.github.com/pnpm/pnpm/issues/11636).

- Fix lockfile parsing failures when `pnpm-lock.yaml` contains CRLF line
endings and multiple YAML documents
[#&#8203;11612](https://redirect.github.com/pnpm/pnpm/issues/11612).

- Anchor the side-effects-cache key and global-virtual-store hash to the
project's script-runner Node — `engines.runtime` pin when present, shell
`node` otherwise — instead of pnpm's own runtime.

`ENGINE_NAME` (the `<platform>;<arch>;node<major>` prefix used as the
side-effects-cache key and the engine portion of the GVS hash) was
computed from `process.version` — the Node that runs pnpm itself. That
was wrong in two situations:

1. **`@pnpm/exe` SEA bundle.** The bundle has its own embedded Node, not
the `node` on the user's `PATH` that actually spawns lifecycle scripts.
Two pnpm installations on the same machine (one SEA, one npm-package)
therefore disagreed on the cache key, partitioning the side-effects
cache and the global virtual store across two Node majors even though
both installs would run scripts on the same shell `node`.
2. **`engines.runtime` / `devEngines.runtime` pin.** When a project pins
a Node version via `devEngines.runtime` (pnpm v11+), pnpm downloads that
Node into `node_modules/node/` and uses it to run lifecycle scripts. But
the hash still anchored to whichever Node ran pnpm itself, not to the
pinned Node — so two installs of the same project with two different
runner Nodes would still disagree on the GVS slot path even though
scripts run on the same pinned Node.

  Three changes:

- `@pnpm/engine.runtime.system-node-version` now exports
`engineName(nodeVersion?)`. Resolves the version in this order: explicit
override → `getSystemNodeVersion()` (which already prefers `node
--version` over `process.version` in SEA contexts) → `process.version`.
- `@pnpm/deps.graph-hasher` now exports
`findRuntimeNodeVersion(snapshotKeys)` — scans an iterable of lockfile
snapshot keys for a `node@runtime:<version>` entry and returns its bare
version string. `calcDepState` and
`calcGraphNodeHash`/`iterateHashedGraphNodes` accept a `nodeVersion?`
(in the options bag for the first, as a trailing parameter / ctx field
for the others), forwarded to `engineName()`. The default (no override)
preserves the pre-change behaviour. The legacy `ENGINE_NAME` constant in
`@pnpm/constants` is unchanged so external consumers and existing tests
keep working; in non-SEA, non-pinned contexts every value lines up.
- Every install-side caller of the graph-hasher
(`@pnpm/installing.deps-resolver`, `@pnpm/installing.deps-restorer`,
`@pnpm/installing.deps-installer`, `@pnpm/building.during-install`,
`@pnpm/building.after-install`, `@pnpm/deps.graph-builder`) now derives
the project's pinned runtime via
`findRuntimeNodeVersion(Object.keys(graph))` once per invocation and
threads it through.

  On upgrade, two one-time GVS slot churns are possible:

- **SEA-pnpm users** without a runtime pin: slots that previously hashed
under the embedded-Node major (e.g. `node26`) now hash under the
shell-Node major (e.g. `node24`), matching what pacquet, the
npm-published `pnpm` package, and any other pnpm-compatible tool already
produce.
- **Projects with a `devEngines.runtime` pin**: slots that previously
hashed under the runner's Node major now hash under the pinned Node
major, matching what the lifecycle scripts will actually run on.

  In both cases the old slots become prune-eligible.

- Resolve the GVS hash's engine portion per-snapshot when a dependency
declares its own `engines.runtime`, instead of using an install-wide
value.

Pnpm's resolver desugars a dep's `engines.runtime` into
`dependencies.node: 'runtime:<version>'`, and the bin linker spawns that
dep's lifecycle scripts through the pinned Node downloaded into
`<pkgDir>/node_modules/node/`. The GVS hash and the side-effects-cache
key prefix were still anchored to the install-wide runtime — so a
pinning snapshot's slot encoded the wrong Node major, and a reinstall on
the same host could read the cached side-effects under a key whose
`<platform>;<arch>;node<major>` triple disagreed with the Node the build
actually ran on.

Per-snapshot resolution now matches what `bins/linker` already does on a
per-package basis:

- `@pnpm/deps.graph-hasher` adds `readSnapshotRuntimePin(children)` —
reads the `node` entry from one snapshot's graph children and extracts
the version from a `node@runtime:` value. Pairs with the existing
`findRuntimeNodeVersion(snapshotKeys)` install-wide fallback (also now
exported from `@pnpm/deps.graph-hasher` rather than
`@pnpm/engine.runtime.system-node-version`, where it was a poor fit —
`system-node-version` is about probing the host Node, not parsing
lockfile-derived strings).
- `calcDepState` and `calcGraphNodeHash` consult
`readSnapshotRuntimePin(graph[depPath].children)` first and only fall
back to the install-wide `nodeVersion` parameter when the snapshot
doesn't pin its own Node.

Pacquet mirrors the same precedence at the `calc_graph_node_hash` call
site in `package-manager/src/virtual_store_layout.rs` — a new
`find_own_runtime_node_major(snapshot)` helper reads each snapshot's
`dependencies` for a `node` entry with `Prefix::Runtime` and overrides
the install-wide engine when present.

On upgrade, snapshots of dependencies that declare their own
`engines.runtime` re-hash under that dep's pinned Node instead of the
install-wide value. The old slots become prune-eligible. Closes
[#&#8203;11690](https://redirect.github.com/pnpm/pnpm/issues/11690).

- Fixed `pnpm publish` failing with a 404 when authentication relied on
OIDC trusted publishing alongside an `.npmrc` written by
`actions/setup-node` (`_authToken=${NODE_AUTH_TOKEN}`) without
`NODE_AUTH_TOKEN` being set. Unresolved `${VAR}` placeholders in auth
values are now treated as empty rather than passed through verbatim, so
the literal placeholder no longer surfaces as a bearer token when OIDC
fallback is the intended auth source
[#&#8203;11513](https://redirect.github.com/pnpm/pnpm/issues/11513).

- Fix `devEngines.packageManager` (singular form, without `onFail`)
defaulting to `onFail: "error"` instead of the documented `pmOnFail:
"download"`. As a result, a project that pinned a different pnpm version
via `devEngines.packageManager` and ran `pnpm install` from a mismatched
pnpm version failed with a hard error, even though the migration table
from `managePackageManagerVersions: true` to `pmOnFail: download
(default)` promises the install would auto-download the wanted version
[#&#8203;11676](https://redirect.github.com/pnpm/pnpm/issues/11676).

The array form of `devEngines.packageManager` keeps its existing
per-element defaults (`error` for the last entry, `ignore` for the
rest), since those reflect explicit prioritization by the user. Explicit
`onFail` values continue to win.

- Fix `devEngines.packageManager` not writing
`packageManagerDependencies` to `pnpm-lock.yaml` when the lockfile lacks
an env-doc entry. Previously the lockfile sync skipped resolution unless
an existing `packageManagerDependencies.pnpm` entry needed refreshing,
so a fresh install without `onFail: "download"` left the resolved pnpm
version unrecorded — contradicting the documented behavior that the
resolved version is stored in `pnpm-lock.yaml`
[#&#8203;11674](https://redirect.github.com/pnpm/pnpm/issues/11674).

- Warn when `package.json` contains a legacy `pnpm` field with settings
pnpm no longer reads from `package.json` (e.g. `pnpm.overrides`,
`pnpm.patchedDependencies`). Previously these were silently ignored
after the upgrade from v10, leaving users unaware that their
overrides/patched dependencies had stopped taking effect
[#&#8203;11677](https://redirect.github.com/pnpm/pnpm/issues/11677).

###
[`v11.1.2`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1112)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.1.1...v11.1.2)

##### Patch Changes

- `convertEnginesRuntimeToDependencies`: switch the runtime-dependency
write to `Object.defineProperty` so the CodeQL
`js/prototype-polluting-assignment` rule treats the assignment as safe
regardless of the property name (follow-up to
[#&#8203;11609](https://redirect.github.com/pnpm/pnpm/pull/11609)).

- Address CodeQL static-analysis findings: guard manifest dependency
writes against prototype-polluting keys (`__proto__`, `constructor`,
`prototype`), and replace a potentially super-linear semver-detection
regex in registry 404 hints with an O(n) parser.

- Strip `sec-fetch-*` headers from outgoing HTTP requests. These headers
are automatically added by undici's `fetch()` implementation per the
Fetch spec but cause Azure DevOps Artifacts to return HTTP 400 for
uncached upstream packages, as ADO interprets them as browser requests
[#&#8203;11572](https://redirect.github.com/pnpm/pnpm/issues/11572).

- Fix `minimumReleaseAge` handling for cached abbreviated metadata.

The version-spec cache fast path no longer rethrows
`ERR_PNPM_MISSING_TIME` under `strictPublishedByCheck`; it now falls
through to the registry-fetch path, consistent with the adjacent
mtime-gated cache block.

When the registry returns 304 Not Modified for a package whose cached
metadata is abbreviated (no per-version `time`), pnpm now re-fetches
with `fullMetadata: true` if `minimumReleaseAge` is active and the
package was modified after the cutoff. The upgraded metadata is
persisted to disk so subsequent installs don't repeat the fetch.
Previously the abbreviated meta was used as-is and the maturity check
fell back to its warn-and-skip path, silently bypassing the quarantine
and emitting a misleading "metadata is missing the time field" warning.

Closes
[#&#8203;11619](https://redirect.github.com/pnpm/pnpm/issues/11619).

- Fix `pnpm upgrade --interactive --latest -r` not respecting named
catalog groups. Previously, upgrading a dependency using a named catalog
(e.g. `"catalog:foo"`) would incorrectly rewrite `package.json` to
`"catalog:"` and place the updated version in the default catalog
instead of the named one
[#&#8203;10115](https://redirect.github.com/pnpm/pnpm/issues/10115).

- Fixed `optimisticRepeatInstall` skipping `pnpm-lock.yaml` merge
conflict resolution when the existing `node_modules` state appears up to
date.

- Fix `minimumReleaseAge` / `resolutionMode: time-based` installs
failing on lockfiles whose `time:` block is missing entries. The
npm-resolver's peek-from-store fast path now surfaces `publishedAt` from
the lockfile rather than discarding it, and falls through to a registry
metadata fetch when the time-based cutoff can't be computed from the
data on hand.

###
[`v11.1.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1111)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.1.0...v11.1.1)

##### Patch Changes

- Skip installability validation when scanning workspace projects in
`checkDepsStatus` (run by `verifyDepsBeforeRun`). Previously the status
check called `findWorkspaceProjects`, which validates each project's
`engines` and `os`/`cpu`/`libc` and warns about useless fields in
non-root manifests — work that the install pipeline already performs.
With no `nodeVersion` threaded through, the engine check also fell back
to the system Node from `PATH` and emitted spurious "Unsupported engine"
warnings before scripts ran. Status-only callers now use
`findWorkspaceProjectsNoCheck`; install paths continue to validate.
- Fixed `pnpm add <alias>:@&#8203;scope/pkg` for [named
registries](https://redirect.github.com/pnpm/pnpm/pull/11324). The local
resolver was claiming any specifier containing `/` as a local directory,
so `pnpm add bit:@&#8203;teambit/bit` (with `bit` configured under
`namedRegistries`) installed a bogus link to `bit:@&#8203;teambit/bit/`
instead of resolving from the configured registry. The local resolver
now runs after the named-registry resolver in the resolution chain.
- Updated `@zkochan/cmd-shim` to 9.0.3. The sh shim it writes for `.cmd`
/ `.bat` targets now escapes the `/C` switch as `//C`, so it survives
the path translation Git Bash applies when launching `cmd.exe`. Without
this, a bare `/C` was rewritten to `C:\` before reaching cmd.exe — the
switch was dropped, cmd started interactively, and the calling script
saw the cmd banner instead of the wrapped command's output. Affects any
cmd-shim-wrapped batch script invoked from Git Bash / MSYS / Cygwin on
Windows. See
[pnpm/cmd-shim#55](https://redirect.github.com/pnpm/cmd-shim/pull/55).

###
[`v11.1.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1110)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.0.9...v11.1.0)

##### Minor Changes

- Added `pnpm audit signatures` to verify ECDSA registry signatures for
installed packages against keys from `/-/npm/v1/keys`
[#&#8203;7909](https://redirect.github.com/pnpm/pnpm/issues/7909).
Scoped registries are respected, and registries without signing keys are
skipped.

- Added support for installing packages from the [GitHub Packages npm
registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-npm-registry)
via a built-in `gh:` prefix (e.g. `pnpm add gh:@&#8203;acme/private`),
and, more broadly, for arbitrary named registries in the style of [vlt's
named-registry aliases](https://docs.vlt.sh/cli/registries).
Authentication is picked up from the existing per-URL `.npmrc` entries
(e.g. `//npm.pkg.github.com/:_authToken=...`), so no separate auth
mechanism is required.

Additional aliases — or an override for the built-in `gh` alias, for
GitHub Enterprise Server — can be configured under `namedRegistries` in
`pnpm-workspace.yaml`:

  ```yaml
  namedRegistries:
    gh: https://npm.pkg.github.example.com/
    work: https://npm.work.example.com/
  ```

With this, `work:@&#8203;corp/lib@^2.0.0` resolves against
`https://npm.work.example.com/`.
[#&#8203;8941](https://redirect.github.com/pnpm/pnpm/issues/8941).

- Allow setting sbom spec version using `--sbom-spec-version`
[#&#8203;11389](https://redirect.github.com/pnpm/pnpm/pull/11389).

- Add `--no-runtime` flag (config: `runtime=false`) to skip installing
runtime entries (e.g. Node.js downloaded via `devEngines.runtime`)
without modifying the lockfile. The lockfile keeps the runtime entry so
frozen-lockfile validation still passes; only the runtime fetch and
`.bin` linking are skipped. Useful in CI matrices where the runtime is
provisioned externally (e.g. via `pnpm runtime -g set node <version>`)
before `pnpm install` runs.

- Added the `pnpm bugs` command that opens a package's bug tracker URL
in the browser. With no arguments, it reads the current project's
`package.json`; with one or more package names, it fetches each
package's metadata from the registry and opens its bug tracker. Falls
back to `<repository>/issues` when the `bugs` field is missing
[#&#8203;11279](https://redirect.github.com/pnpm/pnpm/pull/11279).

- Added `pnpm owner` command to manage package owners on the registry.

##### Patch Changes

- Added "published X ago by Y" information to the `pnpm view` command
output, similar to `npm view`. This is useful when comparing against
`minimumReleaseAge`.

  For example, `pnpm view pnpm` now shows:

  ```
  published 17 hours ago by GitHub Actions
  ```

- `pnpm publish` now honors the configured HTTP/HTTPS proxy (including
`https_proxy`/`http_proxy`/`no_proxy` environment variables) when
polling the registry's `doneUrl` during the web-based authentication
flow. Previously the poll bypassed the proxy, causing the registry to
respond `403` from a different source IP and the login to never complete
[#&#8203;11561](https://redirect.github.com/pnpm/pnpm/issues/11561).

- `pnpm add -g` now installs each space-separated package into its own
isolated directory by default. To bundle multiple packages into the same
isolated install (so that they share dependencies and are removed
together), pass them as a comma-separated list. For example:

- `pnpm add -g foo bar` installs `foo` and `bar` as two independent
globals — removing one does not affect the other.
- `pnpm add -g foo,bar qar` bundles `foo` and `bar` into a single
isolated install while `qar` is installed on its own.

Related:
[#&#8203;11587](https://redirect.github.com/pnpm/pnpm/issues/11587).

- `pnpm runtime set <name> <version>` no longer fails in the root of a
multi-package workspace with the `ADDING_TO_ROOT` error. Installing the
workspace root is a valid target for a runtime, so the command now
bypasses that safety check.

- Fix `pnpm --version` hanging for the lifetime of the worker pool after
the version was printed. `main.ts`'s `--version` short-circuit returned
before reaching the command-handler `finally` that calls
`finishWorkers()`, so the worker pool that `switchCliVersion` had
spawned during integrity resolution stayed alive and held the Node event
loop open. The CLI entry now runs `finishWorkers()` from its own
`finally`, so every exit path tears the pool down.

Repro: `pnpm --version` in a workspace whose `devEngines.packageManager`
version already matches the running pnpm + `onFail: "download"`.
`switchCliVersion` resolves the integrity (spawning workers), finds
nothing to swap, returns. The version prints, then the process hangs.

###
[`v11.0.9`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1109)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.0.8...v11.0.9)

##### Patch Changes

- Fixed installation of GitLab-hosted dependencies. pnpm now downloads
the tarball from
`https://gitlab.com/<user>/<project>/-/archive/<sha>/<project>-<sha>.tar.gz`
instead of the GitLab API endpoint that contained an encoded slash
(`%2F`) between user and project. The encoded slash both triggered `406
Not Acceptable` responses from GitLab and produced virtual store
directory names that Node refused to import
(`ERR_INVALID_MODULE_SPECIFIER`)
[#&#8203;11533](https://redirect.github.com/pnpm/pnpm/issues/11533).
- Honor `NPM_CONFIG_USERCONFIG` (and its lowercase
`npm_config_userconfig` form) as a low-priority fallback when locating
the user-level `.npmrc`. This restores compatibility with environments
that point npm at a custom auth file via that env var — most notably
`actions/setup-node`, which writes registry credentials to
`${runner.temp}/.npmrc` and exports `NPM_CONFIG_USERCONFIG` to reference
it. Without this, GitHub Actions workflows using `actions/setup-node` to
authenticate to private registries broke after upgrading to pnpm v11.
PNPM-prefixed env vars and `npmrcAuthFile` from the global `config.yaml`
continue to take precedence
[#&#8203;11539](https://redirect.github.com/pnpm/pnpm/issues/11539).
- Fix `pnpm pack` not bundling dependencies listed in
`bundleDependencies` (or `bundledDependencies`). The npm-packlist
upgrade in pnpm 11 changed its API to require the caller to pre-populate
the dependency tree, which the wrapper was not doing —
`bundleDependencies` were silently dropped from the tarball
[#&#8203;11519](https://redirect.github.com/pnpm/pnpm/issues/11519).
- Fixed the pnpm CLI crashing with a confusing `SyntaxError: Invalid
regular expression flags` instead of printing a clear "requires Node.js
v22.13" error when launched on an unsupported Node.js version. The
Node.js version check in `bin/pnpm.mjs` was effectively dead code
because the static `import` of the bundled `dist/pnpm.mjs` was hoisted
by the ES module loader and parsed before the check could run
[#&#8203;11546](https://redirect.github.com/pnpm/pnpm/issues/11546).
- Fixed `pnpm --prefix=<dir> install` overwriting the existing
`pnpm-workspace.yaml` in `<dir>` with `set this to true or false`
placeholders. The renamed `--prefix` option (which maps to `dir`) was
not honored when locating the workspace root, so the workspace
manifest's `allowBuilds` settings were not loaded into config and got
clobbered when ignored builds were auto-populated
[#&#8203;11535](https://redirect.github.com/pnpm/pnpm/issues/11535).
- Fixed `pnpm publish --provenance` failing with a 422 from the registry
when the package version contained semver build metadata (e.g.
`1.0.0-canary.0+abc1234`). The `+<build>` segment is now stripped before
packing so that the version embedded in the tarball, the metadata sent
to the registry, and the sigstore provenance subject all agree
[#&#8203;11518](https://redirect.github.com/pnpm/pnpm/issues/11518).

###
[`v11.0.8`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1108)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.0.7...v11.0.8)

##### Patch Changes

- Restored the heuristic that preserves tarball URLs in `pnpm-lock.yaml`
when they cannot be derived from name+version+registry, even with the
default `lockfileIncludeTarballUrl: false`. Without this, `pnpm install
--frozen-lockfile` from an empty store fails with `ERR_PNPM_FETCH_404`
for packages on registries that serve tarballs from a non-standard path
— most notably GitHub Packages
(`https://npm.pkg.github.com/download/<scope>/<name>/<version>/<hash>`)
and JSR. `lockfileIncludeTarballUrl: true` continues to force the URL
into the lockfile for every package
[#&#8203;11276](https://redirect.github.com/pnpm/pnpm/issues/11276).
- Run `preversion`, `version`, and `postversion` lifecycle scripts for
`pnpm version`.
- Fixed `ERR_PNPM_BAD_TARBALL_SIZE` when a registry serves tarballs with
an end-to-end `Content-Encoding` (e.g. `gzip`). Tarballs are already
compressed, so the fetcher now requests them with `Accept-Encoding:
identity` (matching pnpm v10's effective behavior) and, as defense in
depth against misbehaving servers, no longer enforces the strict
`Content-Length` check when the response declares a `Content-Encoding` —
`Content-Length` in that case refers to the encoded payload, not the
decoded bytes the fetch implementation yields
[#&#8203;11506](https://redirect.github.com/pnpm/pnpm/issues/11506).

###
[`v11.0.7`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1107)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.0.6...v11.0.7)

##### Patch Changes

- Restore the execute bit on the `node-gyp` shims packed inside
`@pnpm/exe` (`dist/node-gyp-bin/node-gyp`,
`dist/node-gyp-bin/node-gyp.cmd`, and
`dist/node_modules/node-gyp/bin/node-gyp.js`). Without this,
`pnpm/action-setup`'s standalone path (used on runners with Node.js <
22.13) failed any install whose lifecycle script invoked `node-gyp
rebuild` with `sh: 1: node-gyp: Permission denied`
[#&#8203;11483](https://redirect.github.com/pnpm/pnpm/issues/11483).

- Fixed the `pn`, `pnpx`, and `pnx` aliases failing in Git Bash / MSYS2
on Windows when pnpm was installed via `@pnpm/exe` (or after `pnpm
self-update`)
[#&#8203;11486](https://redirect.github.com/pnpm/pnpm/issues/11486).
Running `pnpx` (or `pnx`) printed the cmd.exe banner and dropped the
user into an interactive command prompt instead of running `pnpm dlx`.
The `bin` field rewrite on Windows was pointing those aliases at `.cmd`
files; cmd-shim's Bash shim for a `.cmd` target wraps it in `exec cmd /C
...`, and MSYS2 mangles `/C` into a Windows path before cmd.exe sees it.
The aliases are now `.exe` hardlinks of the SEA binary, which detects
which name it was launched as via `process.execPath` and prepends `dlx`
for `pnpx` / `pnx`.

- Fix `pnpm install` recreating `node_modules` after `pnpm fetch`. `pnpm
fetch` records empty `hoistPattern` and `publicHoistPattern` in
`.modules.yaml`; since v11 removed the explicit-config gate, the
follow-up install treated those as a hoist-pattern change and purged the
modules directory. The fetch step now flags the modules manifest with
`virtualStoreOnly: true` so the next install skips the hoist-pattern
comparison and completes the missing post-import linking in place
[#&#8203;11488](https://redirect.github.com/pnpm/pnpm/issues/11488).

- Pin the integrity of git-hosted tarballs (codeload.github.com,
gitlab.com, bitbucket.org) in the lockfile so that subsequent installs
detect a tampered or substituted tarball and refuse to install it.
Previously the lockfile only stored the tarball URL for git
dependencies, so a compromised git host or a man-in-the-middle could
serve arbitrary code on later installs without lockfile changes.

A new `gitHosted: true` field is recorded on git-hosted tarball
resolutions in the lockfile, letting every reader/writer route them by a
single typed check instead of pattern-matching the tarball URL in each
call site. Lockfiles written by older pnpm versions are enriched on load
(URL fallback) so the field can be relied on uniformly across the
codebase.

- Allow user-level preferences in the global `config.yaml`. The
following settings can now be set in `~/.config/pnpm/config.yaml` (or
via `pnpm config set --location global`) instead of being restricted to
`pnpm-workspace.yaml`: `agent`, `globalVirtualStoreDir`,
`initPackageManager`, `initType`, `registrySupportsTimeField`,
`scriptShell`, `shellEmulator`, `sideEffectsCache`,
`sideEffectsCacheReadonly`, `stateDir`, `strictDepBuilds`,
`trustPolicy`, `trustPolicyExclude`, `trustPolicyIgnoreAfter`,
`updateNotifier`, `useStderr`, `verifyDepsBeforeRun`,
`verifyStoreIntegrity`, `virtualStoreDir`, `virtualStoreDirMaxLength`
[#&#8203;11474](https://redirect.github.com/pnpm/pnpm/issues/11474).

- Make trusted publishing (OIDC) take precedence over a configured
static `_authToken` in `pnpm publish`, mirroring the npm CLI's behavior.
When OIDC succeeds, the OIDC-derived token overrides any pre-configured
`_authToken`; when OIDC is not applicable (no CI environment, exchange
fails, registry has no trusted publisher configured), the static token
is used as a fallback. This applies on every package during recursive
publish, so each workspace package independently attempts trusted
publishing.

Additionally, the `NPM_ID_TOKEN` env var is now honored as a CI-agnostic
injection point for an OIDC ID token. Previously OIDC was only attempted
on GitHub Actions or GitLab; now any CI provider that exposes its own
OIDC mechanism (e.g. CircleCI's `CIRCLE_OIDC_TOKEN_V2`, Buildkite, etc.)
can forward its token via `NPM_ID_TOKEN` and trusted publishing will
work without pnpm needing to recognize the provider explicitly.

- `--pm-on-fail=ignore` (and other universal options like `--loglevel`,
`--reporter`) is now honored when combined with `--help` or `--version`.
Previously the CLI argument parser short-circuited those flags before
universal options were preserved, so `pnpm audit --pm-on-fail=ignore
--help` and `pnpm --pm-on-fail=ignore --version` reported the strict
packageManager mismatch instead of running the requested action
[#&#8203;11487](https://redirect.github.com/pnpm/pnpm/issues/11487).

- Fix a regression where `pnpm --recursive --filter '!<pkg>'
run/exec/test/add` would include the workspace root in the matched
projects. The workspace root is now correctly excluded by default when
only negative `--filter` arguments are provided, matching the
[documented behavior](https://pnpm.io/cli/recursive). To include the
root, pass `--include-workspace-root`
[#&#8203;11341](https://redirect.github.com/pnpm/pnpm/issues/11341).

- Restore npm-CLI-compatible `--json` stdout output for `pnpm publish`
([#&#8203;11476](https://redirect.github.com/pnpm/pnpm/issues/11476)).
pnpm 11 reimplemented publish natively
([#&#8203;10591](https://redirect.github.com/pnpm/pnpm/pull/10591)) and
inadvertently dropped the per-package JSON object that pnpm 10 emitted
transitively via the npm CLI, silently breaking downstream tooling —
most notably `nx release publish`, which parses stdout JSON to confirm
success
([nrwl/nx#35575](https://redirect.github.com/nrwl/nx/issues/35575)). On
success, the output is now:

- `pnpm publish --json` → single object `{ id, name, version, size,
unpackedSize, shasum, integrity, filename, files, entryCount, bundled
}`, mirroring `npm publish --json`.
- `pnpm publish -r --json` → array of those objects, mirroring `pnpm
pack --json`'s shape choice.
- `pnpm publish -r --report-summary` → existing
`pnpm-publish-summary.json` envelope `{ publishedPackages: [...] }` is
preserved, but each entry is upgraded to the same per-package shape
(additive — `name` and `version` are still present).

- `pnpm config get @&#8203;<scope>:registry` now reports the same URL
that `pnpm publish` and the resolvers actually use. Previously, `config
get` only consulted `.npmrc`, while `publish`/install used the merged
map that includes `pnpm-workspace.yaml`'s `registries` block — so the
two could diverge silently and a publish could go to the wrong registry
[#&#8203;11492](https://redirect.github.com/pnpm/pnpm/issues/11492).

###
[`v11.0.6`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1106)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.0.5...v11.0.6)

##### Patch Changes

- Fix `pnpm_config_npmrc_auth_file` and `pnpm_config_userconfig` env
vars not actually loading the custom `.npmrc`. The env vars were parsed
and assigned to the resolved config, but only after `loadNpmrcConfig`
had already read the default `~/.npmrc` — so the custom file path was
set but never read. The relevant env vars are now consulted before the
user-level `.npmrc` is loaded
[#&#8203;11465](https://redirect.github.com/pnpm/pnpm/issues/11465).
- Preserve the original key order in `pnpm-workspace.yaml` when updating
it. Existing keys keep their position, and new keys are inserted in
alphabetical position when the existing keys are already sorted (with a
leading `packages` key allowed) or appended at the end otherwise.
- Fixed `pnpm self-update` on installations originally set up by pnpm
v10. v10 added `PNPM_HOME` directly to PATH and wrote a `pnpm` bootstrap
shim there. v11 setup writes shims under `PNPM_HOME/bin` instead, so
when a v10 user upgrades to v11 the legacy shim at `PNPM_HOME` keeps
pointing into the old `.tools/<version>` install — `pnpm --version`
continues to report the pre-update version even though the new version
was installed under `global/v11`. Self-update now detects this layout,
refreshes the legacy shims so the upgrade actually takes effect, and
prints a hint suggesting `pnpm setup` to migrate PATH to the v11 layout.
[#&#8203;11464](https://redirect.github.com/pnpm/pnpm/issues/11464).
- Print a warning when settings that are not allowed in the global
config file (e.g. `nodeLinker`, `hoistPattern`) are present in
`config.yaml` and silently ignored. Previously these settings were
dropped without any feedback, leaving users unsure why their global
configuration had no effect. The warning suggests moving those settings
to a project-level `pnpm-workspace.yaml`, or sharing them across
projects via [config
dependencies](https://pnpm.io/11.x/config-dependencies).
- Throw a pnpm error when `overrides` has an invalid shape or contains a
non-string value.
- Validate all `readPackage` dependency map fields, including
`devDependencies`, and reject falsy non-object invalid values instead of
silently accepting them.
- Prevent crashes during `pnpm config`, `pnpm set`, and `pnpm get` by
tolerating `configDependencies` install failures. For these commands, a
failure to install `configDependencies` (for example because the
registry auth token has not been written yet) is now logged at debug
level and the command proceeds. All other commands still surface the
install error
[#&#8203;10684](https://redirect.github.com/pnpm/pnpm/issues/10684).
- Treat `allowBuilds` as an install-state input and clear previously
ignored builds when they are explicitly disallowed.
- Fixes
[#&#8203;10594](https://redirect.github.com/pnpm/pnpm/issues/10594),
catalogs not being read from the workspace when using the `catalog:`
protocol with the `pnpm dlx` / `pnpx` command, resulting in a catalog
entry not found error.
- Accept `PNPM_CONFIG_*` (uppercase) environment variables in addition
to `pnpm_config_*`. Previously, only the lowercase form was honored, so
env vars renamed

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on the first day of the month"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIwMi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-05-31 21:35:36 +01:00
renovate d463c5a457 chore(deps): update dependency oxfmt to ^0.52.0 (#22738) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt)) | [`^0.51.0` → `^0.52.0`](https://renovatebot.com/diffs/npm/oxfmt/0.51.0/0.52.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.52.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.52.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.51.0/0.52.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.51.0/0.52.0?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

### [`v0.52.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0520---2026-05-26)

[Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.51.0...oxfmt_v0.52.0)

##### 🚀 Features

- [`16b8058`](https://redirect.github.com/oxc-project/oxc/commit/16b8058) oxfmt: Support `vite-plus/resolveConfig` for vite.config.ts ([#&#8203;22454](https://redirect.github.com/oxc-project/oxc/issues/22454)) (leaysgur)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE5NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-05-26 08:33:29 +00:00
renovate 55a3158a8a chore(deps): update dependency oxlint to v1.66.0 (#22569) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint](https://oxc.rs/docs/guide/usage/linter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxlint)) | [`1.65.0` → `1.66.0`](https://renovatebot.com/diffs/npm/oxlint/1.65.0/1.66.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint/1.66.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint/1.66.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint/1.65.0/1.66.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint/1.65.0/1.66.0?slim=true) |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the warning logs for more information.

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxlint)</summary>

### [`v1.66.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1660---2026-05-18)

[Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.65.0...oxlint_v1.66.0)

##### 🚀 Features

- [`0440b0f`](https://redirect.github.com/oxc-project/oxc/commit/0440b0f) linter/eslint: Implement `id-match` rule ([#&#8203;22379](https://redirect.github.com/oxc-project/oxc/issues/22379)) (Vladislav Sayapin)
- [`65bf119`](https://redirect.github.com/oxc-project/oxc/commit/65bf119) linter: Implement react no-object-type-as-default-prop ([#&#8203;22481](https://redirect.github.com/oxc-project/oxc/issues/22481)) (uhyo)
- [`2a6ddce`](https://redirect.github.com/oxc-project/oxc/commit/2a6ddce) linter/eslint: Implement `no-implied-eval` rule ([#&#8203;22391](https://redirect.github.com/oxc-project/oxc/issues/22391)) (Vladislav Sayapin)
- [`625758a`](https://redirect.github.com/oxc-project/oxc/commit/625758a) linter/vitest: Implement padding-around-after-all-blocks rule ([#&#8203;21788](https://redirect.github.com/oxc-project/oxc/issues/21788)) (kapobajza)
- [`37680b0`](https://redirect.github.com/oxc-project/oxc/commit/37680b0) linter: Implement react no-unstable-nested-components ([#&#8203;22248](https://redirect.github.com/oxc-project/oxc/issues/22248)) (Jovi De Croock)
- [`d8d9c74`](https://redirect.github.com/oxc-project/oxc/commit/d8d9c74) linter: Implement import/newline-after-import rule ([#&#8203;19142](https://redirect.github.com/oxc-project/oxc/issues/19142)) (Ryuya Yanagi)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-05-19 10:17:42 +00:00
renovate f4a98726d1 chore(deps): update dependency oxfmt to ^0.51.0 (#22568) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt)) | [`^0.50.0` → `^0.51.0`](https://renovatebot.com/diffs/npm/oxfmt/0.50.0/0.51.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.51.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.51.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.50.0/0.51.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.50.0/0.51.0?slim=true) |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the warning logs for more information.

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-05-19 08:58:33 +00:00
renovate[bot] 542ed197b1 chore(deps): update dependency oxlint-tsgolint to v0.23.0 (#22522) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) |
[`0.22.1` →
`0.23.0`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.22.1/0.23.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.23.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.23.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.22.1/0.23.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.22.1/0.23.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

###
[`v0.23.0`](https://redirect.github.com/oxc-project/tsgolint/compare/v0.22.1...0e575fae8407227601f66c1d8d8927a535aea58b)

[Compare
Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.22.1...0e575fae8407227601f66c1d8d8927a535aea58b)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzkuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE3OS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-05-18 10:09:53 +01:00
renovate[bot] 795cebf06d chore(deps): update dependency oxfmt to ^0.50.0 (#22466) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.49.0` →
`^0.50.0`](https://renovatebot.com/diffs/npm/oxfmt/0.49.0/0.50.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.50.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.50.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.49.0/0.50.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.49.0/0.50.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.50.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0500---2026-05-15)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.49.0...oxfmt_v0.50.0)

##### 🐛 Bug Fixes

-
[`43b9978`](https://redirect.github.com/oxc-project/oxc/commit/43b9978)
formatter/sort\_imports: Treat subpath imports as internal
([#&#8203;22440](https://redirect.github.com/oxc-project/oxc/issues/22440))
(leaysgur)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzkuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE3OS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-05-15 17:49:10 +00:00
renovate ff859ad01f chore(deps): update dependency oxfmt to ^0.49.0 (#22334) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt)) | [`^0.48.0` → `^0.49.0`](https://renovatebot.com/diffs/npm/oxfmt/0.48.0/0.49.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.49.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.49.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.48.0/0.49.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.48.0/0.49.0?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

### [`v0.49.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0490---2026-05-11)

##### 🚀 Features

- [`6e8e818`](https://redirect.github.com/oxc-project/oxc/commit/6e8e818) oxfmt: Experimental .svelte support ([#&#8203;21700](https://redirect.github.com/oxc-project/oxc/issues/21700)) (leaysgur)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-05-11 20:04:01 +00:00
renovate[bot] 30682346d9 chore(deps): update pnpm to v11 (#22224) 2026-05-07 23:23:38 +08:00
renovate 29eaeac911 chore(deps): update dependency oxfmt to ^0.48.0 (#22150) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt)) | [`^0.47.0` → `^0.48.0`](https://renovatebot.com/diffs/npm/oxfmt/0.47.0/0.48.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.48.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.48.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.47.0/0.48.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.47.0/0.48.0?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

### [`v0.48.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.47.0...oxfmt_v0.48.0)

[Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.47.0...oxfmt_v0.48.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-05-05 15:39:21 +00:00
renovate[bot] 8b91343902 chore(deps): update pnpm to v10.33.2 (#21997) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) |
[`10.33.0` →
`10.33.2`](https://renovatebot.com/diffs/npm/pnpm/10.33.0/10.33.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/10.33.2?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/10.33.2?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/10.33.0/10.33.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/10.33.0/10.33.2?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v10.33.2`](https://redirect.github.com/pnpm/pnpm/compare/v10.33.1...v10.33.2)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v10.33.1...v10.33.2)

###
[`v10.33.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.33.1):
pnpm 10.33.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v10.33.0...v10.33.1)

##### Patch Changes

- When a project's `packageManager` field selects pnpm v11 or newer,
commands that v10 would have passed through to npm (`version`, `login`,
`logout`, `publish`, `unpublish`, `deprecate`, `dist-tag`, `docs`,
`ping`, `search`, `star`, `stars`, `unstar`, `whoami`, etc.) are now
handed over to the wanted pnpm, which implements them natively.
Previously they silently shelled out to npm — making, for example, `pnpm
version --help` print npm's help on a project with `packageManager:
pnpm@11.0.0-rc.3`
[#&#8203;11328](https://redirect.github.com/pnpm/pnpm/issues/11328).

<!-- sponsors -->

##### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80"
alt="Bit"></a>
      </td>
    </tr>
  </tbody>
</table>

##### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg"
width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on the first day of the month"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-30 21:28:35 +00:00
renovate[bot] 0bff7e3b2c chore(deps): update dependency oxlint-tsgolint to v0.22.1 (#21852) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) |
[`0.22.0` →
`0.22.1`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.22.0/0.22.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.22.1?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.22.1?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.22.0/0.22.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.22.0/0.22.1?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

###
[`v0.22.1`](https://redirect.github.com/oxc-project/tsgolint/releases/tag/v0.22.1)

[Compare
Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.22.0...v0.22.1)

#### What's Changed

- fix: clarify `AGENTS.md` submodule guidance by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;909](https://redirect.github.com/oxc-project/tsgolint/pull/909)
- feat(no-unsafe-enum-comparison): implement suggestion by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;910](https://redirect.github.com/oxc-project/tsgolint/pull/910)
- feat(no-unnecessary-template-expression): implement fix by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;911](https://redirect.github.com/oxc-project/tsgolint/pull/911)
- chore(deps): update dependency vitest to v4.1.5 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;912](https://redirect.github.com/oxc-project/tsgolint/pull/912)
- chore(deps): update github-actions by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;913](https://redirect.github.com/oxc-project/tsgolint/pull/913)
- fix(prefer-optional-chain): avoid access comparison false positive by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;914](https://redirect.github.com/oxc-project/tsgolint/pull/914)

**Full Changelog**:
<https://github.com/oxc-project/tsgolint/compare/v0.22.0...v0.22.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-27 16:44:38 +01:00
renovate[bot] 2631644ebb chore(deps): update dependency oxfmt to ^0.47.0 (#21847) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.46.0` →
`^0.47.0`](https://renovatebot.com/diffs/npm/oxfmt/0.46.0/0.47.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.47.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.47.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.46.0/0.47.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.46.0/0.47.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.47.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.46.0...oxfmt_v0.47.0)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.46.0...oxfmt_v0.47.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-27 15:39:57 +01:00
renovate[bot] 568d7cb6d9 chore(deps): update dependency oxlint-tsgolint to v0.22.0 (#21742) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) |
[`0.21.1` →
`0.22.0`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.21.1/0.22.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.22.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.22.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.21.1/0.22.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.21.1/0.22.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

###
[`v0.22.0`](https://redirect.github.com/oxc-project/tsgolint/compare/v0.21.1...42a817b2ac39c364e8b054d00bd1fb0947d0aa3a)

[Compare
Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.21.1...v0.22.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-25 11:51:10 +01:00
renovate 102281cd4b chore(deps): update dependency oxfmt to ^0.46.0 (#21591) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt)) | [`^0.45.0` → `^0.46.0`](https://renovatebot.com/diffs/npm/oxfmt/0.45.0/0.46.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.46.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.46.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.45.0/0.46.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.45.0/0.46.0?slim=true) |

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjMuOCIsInVwZGF0ZWRJblZlciI6IjQzLjEyMy44IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-04-20 20:25:18 +00:00
renovate ccd2db007e chore(deps): update dependency oxlint-tsgolint to v0.21.1 (#21504) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) | [`0.21.0` → `0.21.1`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.21.0/0.21.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.21.1?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.21.1?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.21.0/0.21.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.21.0/0.21.1?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

### [`v0.21.1`](https://redirect.github.com/oxc-project/tsgolint/releases/tag/v0.21.1)

[Compare Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.21.0...v0.21.1)

#### What's Changed

- fix(no-unnecessary-condition): handle null overlap in narrowed generic intersections by [@&#8203;camc314](https://redirect.github.com/camc314) in [#&#8203;891](https://redirect.github.com/oxc-project/tsgolint/pull/891)
- revert(no-unnecessary-type-arguments): drop inference reporting by [@&#8203;camc314](https://redirect.github.com/camc314) in [#&#8203;892](https://redirect.github.com/oxc-project/tsgolint/pull/892)

**Full Changelog**: <https://github.com/oxc-project/tsgolint/compare/v0.21.0...v0.21.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjEyNC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-04-16 14:37:49 +00:00
renovate 59aef8bfaf chore(deps): update dependency oxlint-tsgolint to v0.21.0 (#21424) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) | [`0.20.0` → `0.21.0`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.20.0/0.21.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.21.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.21.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.20.0/0.21.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.20.0/0.21.0?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

### [`v0.21.0`](https://redirect.github.com/oxc-project/tsgolint/compare/v0.20.0...f9adc305c454101984c5f0886f0ce6a71e780d15)

[Compare Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.20.0...v0.21.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjExMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-04-14 13:57:59 +00:00
renovate[bot] 6d4d8a406e chore(deps): update dependency oxfmt to ^0.45.0 (#21381) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.44.0` →
`^0.45.0`](https://renovatebot.com/diffs/npm/oxfmt/0.44.0/0.45.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.45.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.45.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.44.0/0.45.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.44.0/0.45.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.45.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0450---2026-04-13)

[Compare
Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.44.0...oxfmt_v0.45.0)

##### 🐛 Bug Fixes

-
[`50c389b`](https://redirect.github.com/oxc-project/oxc/commit/50c389b)
oxfmt: Support `.editorconfig` `quote_type`
([#&#8203;20989](https://redirect.github.com/oxc-project/oxc/issues/20989))
(leaysgur)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjExMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-13 12:45:51 +00:00
renovate[bot] 60b1678d18 chore(deps): update dependency oxfmt to ^0.44.0 (#21099) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter)
([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt))
| [`^0.43.0` →
`^0.44.0`](https://renovatebot.com/diffs/npm/oxfmt/0.43.0/0.44.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.44.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.44.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.43.0/0.44.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.43.0/0.44.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

###
[`v0.44.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0440---2026-04-06)

##### 🐛 Bug Fixes

-
[`dd2df87`](https://redirect.github.com/oxc-project/oxc/commit/dd2df87)
npm: Export package.json for oxlint and oxfmt
([#&#8203;20784](https://redirect.github.com/oxc-project/oxc/issues/20784))
(kazuya kawaguchi)
-
[`4216380`](https://redirect.github.com/oxc-project/oxc/commit/4216380)
oxfmt: Support `.editorconfig` `tab_width` fallback
([#&#8203;20988](https://redirect.github.com/oxc-project/oxc/issues/20988))
(leaysgur)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ1cGRhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-07 01:58:19 +00:00
renovate[bot] 538d70373d chore(deps): update dependency oxlint-tsgolint to v0.20.0 (#21090) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) |
[`0.19.0` →
`0.20.0`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.19.0/0.20.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.20.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.20.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.19.0/0.20.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.19.0/0.20.0?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

###
[`v0.20.0`](https://redirect.github.com/oxc-project/tsgolint/releases/tag/v0.20.0)

[Compare
Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.19.0...v0.20.0)

#### What's Changed

- chore(deps): update crate-ci/typos action to v1.45.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;863](https://redirect.github.com/oxc-project/tsgolint/pull/863)
- fix(no-unnecessary-type-arguments): handle Partial aliases in
default-type checks by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;862](https://redirect.github.com/oxc-project/tsgolint/pull/862)
- feat: enrich await-thenable diagnostics by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;865](https://redirect.github.com/oxc-project/tsgolint/pull/865)
- feat: enrich no-unsafe-enum-comparison diagnostics by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;867](https://redirect.github.com/oxc-project/tsgolint/pull/867)
- chore(deps): update github-actions by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;870](https://redirect.github.com/oxc-project/tsgolint/pull/870)
- chore(deps): update extractions/setup-crate action to v2 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;871](https://redirect.github.com/oxc-project/tsgolint/pull/871)
- chore(deps): update dependency dprint to v0.53.2 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;869](https://redirect.github.com/oxc-project/tsgolint/pull/869)
- fix(prefer-optional-chain): ignore non-access OR comparison by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;872](https://redirect.github.com/oxc-project/tsgolint/pull/872)
- chore: update typescript-go submodule by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;873](https://redirect.github.com/oxc-project/tsgolint/pull/873)

**Full Changelog**:
<https://github.com/oxc-project/tsgolint/compare/v0.19.0...v0.20.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ1cGRhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Cameron Clark <cameron.clark@hey.com>
 2026-04-06 15:25:27 +01:00
renovate 52489ddd2f chore(deps): update dependency oxlint-tsgolint to v0.19.0 (#20922) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) | [`0.18.1` → `0.19.0`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.18.1/0.19.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.19.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.19.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.18.1/0.19.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.18.1/0.19.0?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

### [`v0.19.0`](https://redirect.github.com/oxc-project/tsgolint/compare/v0.18.1...154e1ee3603a31e4faf3187f3c54e9c4888549f8)

[Compare Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.18.1...154e1ee3603a31e4faf3187f3c54e9c4888549f8)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjEwMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-03-31 22:36:52 +00:00
renovate de1da1656f chore(deps): update pnpm to v10.33.0 (#20902) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`10.30.2` → `10.33.0`](https://renovatebot.com/diffs/npm/pnpm/10.30.2/10.33.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/10.33.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/10.33.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/10.30.2/10.33.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/10.30.2/10.33.0?slim=true) |

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

### [`v10.33.0`](https://redirect.github.com/pnpm/pnpm/compare/v10.32.1...v10.33.0)

[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.32.1...v10.33.0)

### [`v10.32.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.32.1): pnpm 10.32.1

[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.32.0...v10.32.1)

#### Patch Changes

- Fix a regression where `pnpm-workspace.yaml` without a `packages` field caused all directories to be treated as workspace projects. This broke projects that use `pnpm-workspace.yaml` only for settings (e.g. `minimumReleaseAge`) without defining workspace packages [#&#8203;10909](https://redirect.github.com/pnpm/pnpm/issues/10909).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
            <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
            <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
        <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
            <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
            <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
            <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
        <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
            <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
            <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

### [`v10.32.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.32.0): pnpm 10.32

[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.31.0...v10.32.0)

#### Minor Changes

- Added `--all` flag to `pnpm approve-builds` that approves all pending builds without interactive prompts [#&#8203;10136](https://redirect.github.com/pnpm/pnpm/issues/10136).

#### Patch Changes

- Reverted change related to setting explicitly the npm config file path, which caused regressions.
- Reverted fix related to `lockfile-include-tarball-url`. Fixes [#&#8203;10915](https://redirect.github.com/pnpm/pnpm/issues/10915).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
            <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
            <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
        <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
            <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
            <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
            <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
        <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
            <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
            <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

### [`v10.31.0`](https://redirect.github.com/pnpm/pnpm/compare/v10.30.3...v10.31.0)

[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.30.3...v10.31.0)

### [`v10.30.3`](https://redirect.github.com/pnpm/pnpm/compare/v10.30.2...v10.30.3)

[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.30.2...v10.30.3)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 10am on the first day of the month" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjEwMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-03-31 16:22:24 +00:00
renovate a61f5b38b7 chore(deps): update dependency oxfmt to ^0.43.0 (#20898) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt)) | [`^0.42.0` → `^0.43.0`](https://renovatebot.com/diffs/npm/oxfmt/0.42.0/0.43.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.43.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.43.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.42.0/0.43.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.42.0/0.43.0?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

### [`v0.43.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0430---2026-03-30)

[Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.42.0...oxfmt_v0.43.0)

##### 🚀 Features

- [`6ef440a`](https://redirect.github.com/oxc-project/oxc/commit/6ef440a) oxfmt: Support bool for object style options ([#&#8203;20853](https://redirect.github.com/oxc-project/oxc/issues/20853)) (leaysgur)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjEwMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
 2026-03-31 14:11:45 +00:00
renovate 1aec3368fa chore(deps): update dependency oxlint-tsgolint to v0.18.1 (#20815) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) | [`0.18.0` → `0.18.1`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.18.0/0.18.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.18.1?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.18.1?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.18.0/0.18.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.18.0/0.18.1?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

### [`v0.18.1`](https://redirect.github.com/oxc-project/tsgolint/compare/v0.18.0...803b9deda543916305fcef531eb561b4211d54f3)

[Compare Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.18.0...803b9deda543916305fcef531eb561b4211d54f3)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45NC4xIiwidXBkYXRlZEluVmVyIjoiNDMuOTQuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
 2026-03-27 21:35:55 +00:00
renovate 382a469337 chore(deps): update dependency oxlint-tsgolint to v0.18.0 (#20798) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) | [`0.17.4` → `0.18.0`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.17.4/0.18.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.18.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.18.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.17.4/0.18.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.17.4/0.18.0?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

### [`v0.18.0`](https://redirect.github.com/oxc-project/tsgolint/releases/tag/v0.18.0)

[Compare Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.17.4...v0.18.0)

#### What's Changed

- fix(lint): suppress unparam on toStaticValue by [@&#8203;camc314](https://redirect.github.com/camc314) in [#&#8203;834](https://redirect.github.com/oxc-project/tsgolint/pull/834)
- fix(promise-function-async): place async fix after export modifiers by [@&#8203;camc314](https://redirect.github.com/camc314) in [#&#8203;839](https://redirect.github.com/oxc-project/tsgolint/pull/839)
- chore: improve assertion diagnostic msg by [@&#8203;camc314](https://redirect.github.com/camc314) in [#&#8203;842](https://redirect.github.com/oxc-project/tsgolint/pull/842)
- fix(dot-notation): ignore non-ascii property names by [@&#8203;camc314](https://redirect.github.com/camc314) in [#&#8203;840](https://redirect.github.com/oxc-project/tsgolint/pull/840)
- chore: update typescript-go submodule by [@&#8203;camc314](https://redirect.github.com/camc314) in [#&#8203;841](https://redirect.github.com/oxc-project/tsgolint/pull/841)

**Full Changelog**: <https://github.com/oxc-project/tsgolint/compare/v0.17.4...v0.18.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45My4wIiwidXBkYXRlZEluVmVyIjoiNDMuOTMuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
 2026-03-27 13:27:56 +00:00
renovate f05c8e2ace chore(deps): update dependency oxlint-tsgolint to v0.17.4 (#20745) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) | [`0.17.3` → `0.17.4`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.17.3/0.17.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.17.4?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.17.4?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.17.3/0.17.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.17.3/0.17.4?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

### [`v0.17.4`](https://redirect.github.com/oxc-project/tsgolint/releases/tag/v0.17.4)

[Compare Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.17.3...v0.17.4)

#### What's Changed

- chore(deps): remove vite override, update vitest by [@&#8203;camc314](https://redirect.github.com/camc314) in [#&#8203;827](https://redirect.github.com/oxc-project/tsgolint/pull/827)
- fix(prefer-optional-chain): false positive on tricky condition by [@&#8203;camc314](https://redirect.github.com/camc314) in [#&#8203;831](https://redirect.github.com/oxc-project/tsgolint/pull/831)
- fix(no-base-to-string): memoize recursive stringification checks by [@&#8203;camc314](https://redirect.github.com/camc314) in [#&#8203;832](https://redirect.github.com/oxc-project/tsgolint/pull/832)

**Full Changelog**: <https://github.com/oxc-project/tsgolint/compare/v0.17.3...v0.17.4>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
 2026-03-25 18:09:30 +00:00
renovate 329d2e837e chore(deps): update dependency oxfmt to ^0.42.0 (#20694) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt)) | [`^0.41.0` → `^0.42.0`](https://renovatebot.com/diffs/npm/oxfmt/0.41.0/0.42.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.42.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxfmt/0.42.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxfmt/0.41.0/0.42.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.41.0/0.42.0?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

### [`v0.42.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0420---2026-03-24)

[Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.41.0...oxfmt_v0.42.0)

##### 🚀 Features

- [`416865a`](https://redirect.github.com/oxc-project/oxc/commit/416865a) formatter,oxfmt: Add doc comments for `JsdocConfig` ([#&#8203;20644](https://redirect.github.com/oxc-project/oxc/issues/20644)) (leaysgur)
- [`4fec907`](https://redirect.github.com/oxc-project/oxc/commit/4fec907) formatter: Add JSDoc comment formatting support ([#&#8203;19828](https://redirect.github.com/oxc-project/oxc/issues/19828)) (Dunqing)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
 2026-03-24 12:29:53 +00:00
renovate 61ac9455f1 chore(deps): update oxlint (#20685) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint](https://oxc.rs/docs/guide/usage/linter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxlint)) | [`1.56.0` → `1.57.0`](https://renovatebot.com/diffs/npm/oxlint/1.56.0/1.57.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint/1.57.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint/1.57.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint/1.56.0/1.57.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint/1.56.0/1.57.0?slim=true) |
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) | [`0.17.2` → `0.17.3`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.17.2/0.17.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.17.3?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.17.3?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.17.2/0.17.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.17.2/0.17.3?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxlint)</summary>

### [`v1.57.0`](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.56.0...oxlint_v1.57.0)

[Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.56.0...oxlint_v1.57.0)

</details>

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

### [`v0.17.3`](https://redirect.github.com/oxc-project/tsgolint/releases/tag/v0.17.3)

[Compare Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.17.2...v0.17.3)

#### What's Changed

- fix(no-unnecessary-type-assertion): avoid inferring generic defaults from assertions by [@&#8203;camc314](https://redirect.github.com/camc314) in [#&#8203;826](https://redirect.github.com/oxc-project/tsgolint/pull/826)

**Full Changelog**: <https://github.com/oxc-project/tsgolint/compare/v0.17.2...v0.17.3>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
 2026-03-24 12:22:24 +00:00
renovate[bot] fc3c838c02 chore(deps): update dependency oxlint-tsgolint to v0.17.2 (#20673) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [oxlint-tsgolint](https://redirect.github.com/oxc-project/tsgolint) |
[`0.17.1` →
`0.17.2`](https://renovatebot.com/diffs/npm/oxlint-tsgolint/0.17.1/0.17.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint-tsgolint/0.17.2?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/oxlint-tsgolint/0.17.2?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/oxlint-tsgolint/0.17.1/0.17.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint-tsgolint/0.17.1/0.17.2?slim=true)
|

---

### Release Notes

<details>
<summary>oxc-project/tsgolint (oxlint-tsgolint)</summary>

###
[`v0.17.2`](https://redirect.github.com/oxc-project/tsgolint/releases/tag/v0.17.2)

[Compare
Source](https://redirect.github.com/oxc-project/tsgolint/compare/v0.17.1...v0.17.2)

#### What's Changed

- chore: update typescript-go to latest upstream by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;814](https://redirect.github.com/oxc-project/tsgolint/pull/814)
- refactor(no-unnecessary-condition): more closely align rule
implementation with upstream by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;809](https://redirect.github.com/oxc-project/tsgolint/pull/809)
- chore(deps): update dependency dprint-json to v0.21.3 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;819](https://redirect.github.com/oxc-project/tsgolint/pull/819)
- chore(deps): update github-actions by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;820](https://redirect.github.com/oxc-project/tsgolint/pull/820)
- chore(deps): update npm packages by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;821](https://redirect.github.com/oxc-project/tsgolint/pull/821)
- fix(no-unnecessary-type-assertion): avoid contextual generic inference
for call expressions by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;824](https://redirect.github.com/oxc-project/tsgolint/pull/824)
- refactor(no-unnecessary-condition): remove unused `isLiteralValue` by
[@&#8203;camc314](https://redirect.github.com/camc314) in
[#&#8203;825](https://redirect.github.com/oxc-project/tsgolint/pull/825)

**Full Changelog**:
<https://github.com/oxc-project/tsgolint/compare/v0.17.1...v0.17.2>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-03-24 03:36:49 +00:00